SCIFIO vulnerable to Path Traversal

심각 9.8CVE-2022-4493 · GHSA-cmwm-45mj-mpg3 · Published 14/12/2022 · updated 17/06/2026

요약

CVE-2022-4493은(는) io.scif:scifio, scifio (scif)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.58%, 전체 취약점의 48.0%보다 높음.
조치: 0.43.3, 2022-07-29 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
io.scif:scifio Maven	`< 0.43.3`	`0.43.3`
scifio scif	`< 2022-07-29`	`2022-07-29`

Description

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The patch is at commit fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.

NVD description

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.

References

nvd.nist.gov/vuln/detail/CVE-2022-4493 · ADVISORY
scifio/scifio commit fcb0dbc · WEB
scifio/scifio · PACKAGE
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.scif:scifio

Maven

< 0.43.3

0.43.3

scifio

scif

< 2022-07-29

2022-07-29

Description

NVD description

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.