CVE-2022-24774

ALTO 8.1CVE-2022-24774 · Published 22/03/2022 · updated 17/06/2026

In breve

CVE-2022-24774 è una vulnerabilità ALTO (CVSS 8.1) che riguarda bill of materials repository server (cyclonedx).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 73.5% delle vulnerabilità.
Correzione: aggiornare a 2.0.1 o successiva.

Package	Affected versions	Patched versions
bill of materials repository server cyclonedx	`< 2.0.1`	`2.0.1`

Description

CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.

References

CycloneDX/cyclonedx-bom-repo-server commit 001a327 · Patch
CycloneDX/cyclonedx-bom-repo-server release v2.0.1 · Release Notes
CycloneDX/cyclonedx-bom-repo-server security advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free