CVE-2022-23457 — Path Traversal in Esapi Org.owasp.esapi Esapi

CWE-22 — Path Traversal11 documents7 sources
Severity
9.8CRITICALNVD
CNA7.5
EPSS
0.5%
top 36.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Owasp Esapi Org.owasp.esapi EsapiOwasp Enterprise Security APIOracle Weblogic Server
Timeline
PublishedApr 25
Latest updateApr 16

Description

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in r…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5owasp_esapi/org.owasp.esapi_esapi2.3.0.0 — 2.3.0.0
▶NVDoracle/weblogic_server12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0+2

Patches

Patch: github.com ↗Patch: www.oracle.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Path traversal in the OWASP Enterprise Security API↗2022-04-27
▶
GHSA
Path traversal in the OWASP Enterprise Security API↗2022-04-27
▶
OSV
CVE-2022-23457: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library↗2022-04-25
▶
CVEList
Path Traversal in ESAPI↗2022-04-25
▶

📋Vendor Advisories

6
Ubuntu
ESAPI vulnerabilities↗2026-04-16
▶
Oracle
Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Enterprise Security API) — CVE-2022-23457↗2023-04-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party Patch (Enterprise Security API) — CVE-2022-23457↗2023-01-15
▶
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: User Interface (Enterprise Security API) — CVE-2022-23457↗2022-10-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Centralized Third Party Jars (OWASP Enterprise Security API) — CVE-2022-23457↗2022-07-15
▶
CVE-2022-23457 — Path Traversal | cvebase