CVE-2022-23457
published 2022-04-25CVE-2022-23457: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.83%
85.1th percentile
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libowasp-esapi-java | < libowasp-esapi-java 2.4.0.0-1 (bookworm) | libowasp-esapi-java 2.4.0.0-1 (bookworm) |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| owasp | enterprise_security_api | < 2.3.0.0 | 2.3.0.0 |
| owasp_esapi | org.owasp.esapi_esapi | >= 2.3.0.0 < 2.3.0.0 | 2.3.0.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_oracle9.8HIGH
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
osv·2023-03-10·CVSS 9.8
CVE-2023-28465 [CRITICAL] HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
### Impact
Zip Slip protections implemented in CVE-2023-24057 (GHSA-jqh6-9574-5x22) can be bypassed due a partial path traversal vulnerability.
This issue allows a malicious actor to potentially break out of the `TerminologyCacheManager` cache directory. The impact is limited to sibling directories.
To demonstrate the vulnerability, consider `userControlled.getCanonicalPath().startsWith("/usr/out")` will allow an attacker to access a directory with a name like `/usr/outnot`.
### Why?
To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using
GHSA
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
ghsa·2023-03-10·CVSS 9.8
CVE-2023-28465 [CRITICAL] CWE-22 HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
### Impact
Zip Slip protections implemented in CVE-2023-24057 (GHSA-jqh6-9574-5x22) can be bypassed due a partial path traversal vulnerability.
This issue allows a malicious actor to potentially break out of the `TerminologyCacheManager` cache directory. The impact is limited to sibling directories.
To demonstrate the vulnerability, consider `userControlled.getCanonicalPath().startsWith("/usr/out")` will allow an attacker to access a directory with a name like `/usr/outnot`.
### Why?
To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using
OSV
Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
osv·2022-07-15
CVE-2022-31159 [HIGH] Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
### Overview
A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory.
Thi
GHSA
Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
ghsa·2022-07-15
CVE-2022-31159 [HIGH] CWE-22 Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
### Overview
A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory.
Thi
OSV
Path traversal in the OWASP Enterprise Security API
osv·2022-04-27
CVE-2022-23457 [HIGH] Path traversal in the OWASP Enterprise Security API
Path traversal in the OWASP Enterprise Security API
### Impact
The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.
### Patches
This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.
### Workarounds
Yes; in theory, one _could_ write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected `DefaultValidator` class and then overriding the affected `getValidDir
GHSA
Path traversal in the OWASP Enterprise Security API
ghsa·2022-04-27
CVE-2022-23457 [HIGH] CWE-22 Path traversal in the OWASP Enterprise Security API
Path traversal in the OWASP Enterprise Security API
### Impact
The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.
### Patches
This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.
### Workarounds
Yes; in theory, one _could_ write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected `DefaultValidator` class and then overriding the affected `getValidDir
OSV
CVE-2022-23457: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library
osv·2022-04-25·CVSS 9.8
CVE-2022-23457 [CRITICAL] CVE-2022-23457: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
Ubuntu
ESAPI vulnerabilities
vendor_ubuntu·2026-04-16·CVSS 9.8
CVE-2025-5878 [CRITICAL] ESAPI vulnerabilities
Title: ESAPI vulnerabilities
Summary: Several security issues were fixed in ESAPI.
Jaroslav Lobačevski discovered that ESAPI incorrectly validated directory
paths during path verification. An attacker could possibly use this issue
to bypass directory validation checks, leading to control-flow bypass. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
and Ubuntu 22.04 LTS. (CVE-2022-23457)
Kevin W. Wall and Sebastian Passaro discovered that ESAPI did not properly
sanitize javascript URLs because of an incorrect regular expression. An
attacker could possibly use this issue to perform a cross-site scripting
attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu
20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-24891)
Longlong Gong discovered that
Oracle
Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Enterprise Security API) — CVE-2022-23457
vendor_oracle·2023-04-15·CVSS 9.8
CVE-2022-23457 [HIGH] Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Enterprise Security API) — CVE-2022-23457
Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Enterprise Security API) vulnerability
CVE: CVE-2022-23457
CVSS: 9.8
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party Patch (Enterprise Security API) — CVE-2022-23457
vendor_oracle·2023-01-15·CVSS 7.5
CVE-2022-23457 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Third Party Patch (Enterprise Security API) — CVE-2022-23457
Oracle Oracle Fusion Middleware Risk Matrix: Third Party Patch (Enterprise Security API) vulnerability
CVE: CVE-2022-23457
CVSS: 7.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: User Interface (Enterprise Security API) — CVE-2022-23457
vendor_oracle·2022-10-15·CVSS 7.5
CVE-2022-23457 [HIGH] Oracle Oracle Construction and Engineering Risk Matrix: User Interface (Enterprise Security API) — CVE-2022-23457
Oracle Oracle Construction and Engineering Risk Matrix: User Interface (Enterprise Security API) vulnerability
CVE: CVE-2022-23457
CVSS: 7.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Centralized Third Party Jars (OWASP Enterprise Security API) — CVE-2022-23457
vendor_oracle·2022-07-15·CVSS 9.8
CVE-2022-23457 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Centralized Third Party Jars (OWASP Enterprise Security API) — CVE-2022-23457
Oracle Oracle Fusion Middleware Risk Matrix: Centralized Third Party Jars (OWASP Enterprise Security API) vulnerability
CVE: CVE-2022-23457
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Debian
CVE-2022-23457: libowasp-esapi-java - ESAPI (The OWASP Enterprise Security API) is a free, open source, web applicatio...
vendor_debian·2022·CVSS 7.5
CVE-2022-23457 [HIGH] CVE-2022-23457: libowasp-esapi-java - ESAPI (The OWASP Enterprise Security API) is a free, open source, web applicatio...
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
Scope: local
bookworm: resolved (fixed in 2.4.0.0-1)
bullseye: resolved (fixed in 2.4.0.0-0+deb11u1)
forky: resolved (fixed in 2.4.0.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txthttps://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2https://security.netapp.com/advisory/ntap-20230127-0014/https://securitylab.github.com/advisories/GHSL-2022-008_The_OWASP_Enterprise_Security_API/https://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txthttps://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2https://lists.debian.org/debian-lts-announce/2025/07/msg00010.htmlhttps://security.netapp.com/advisory/ntap-20230127-0014/https://securitylab.github.com/advisories/GHSL-2022-008_The_OWASP_Enterprise_Security_API/https://www.oracle.com/security-alerts/cpujul2022.html
2022-04-25
Published