melisplatform/melis-asset-manager vulnerable to Path Traversal

CAO 7.5CVE-2022-39296 · GHSA-7fj2-rrq6-rphq · Công bố 11/10/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-39296 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng melisplatform/melis-asset-manager, melis-asset-manager (melistechnology).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.9%, cao hơn 80.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.0.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
melisplatform/melis-asset-manager Packagist	`< 5.0.1`	`5.0.1`
melis-asset-manager melistechnology	`< 5.0.1`	`5.0.1`

Mô tả

Impact

Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require authentication.

Users should immediately upgrade to melisplatform/melis-asset-manager >= 5.0.1.

Patches

This issue was addressed by restricting access to files to intended directories only.

References

https://github.com/melisplatform/melis-asset-manager/commit/a0f75918c049aff78953a0bc91c585153595d1bd

For more information

If you have any questions or comments about this advisory, you can contact:

The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
The maintainers, by opening an issue on this repository.

Mô tả của NVD

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-asset-manager` >= 5.0.1. This issue was addressed by restricting access to files to intended directories only.