CVE-2022-4244:
plexus-codehaus vulnerable to directory traversal
7.5
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
9/25/2023
Updated
5/3/2024
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
org.codehaus.plexus:plexus-utils | maven | < 3.0.24 | 3.0.24 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The commit 33a2853df8185b4519b1b8bfae284f03392618ef explicitly adds a security check to the extractFile method in Expand.java to prevent directory traversal. This matches the CVE description about improper path limitation and corresponds to the patched version 3.0.24. The vulnerability existed because the method previously used FileUtils.resolveFile without validating if the resulting path remained within the target directory.