CVE-2022-41951
published 2023-11-27CVE-2022-41951: OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is…
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.95%
57.5th percentile
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oro | platform | 4.1.0 – 4.1.13 | — |
| oro | platform | 4.2.0 – 4.2.10 | — |
| oro | platform | >= 5.0.0 < 5.0.8 | 5.0.8 |
| oroinc | oroplatform | < 5.0.9 | 5.0.9 |
| oroinc | platform | — | — |
| oroinc | platform | — | — |
| oroinc | platform | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OroPlatform vulnerable to path traversal during temporary file manipulations
osv·2023-11-27
CVE-2022-41951 [HIGH] OroPlatform vulnerable to path traversal during temporary file manipulations
OroPlatform vulnerable to path traversal during temporary file manipulations
### Impact
Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`.
With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. The file will be deleted immediately after the script ends.
### Workarounds
Apply patch
```patch
--- a/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
+++ b/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
@@ -614,6 +614,10 @@
*/
public function getTemporaryFileName(string $suggestedFileName = null): string
{
+ if ($suggestedFileName) {
+ $suggestedFileName = basename($suggestedFileName);
+ }
+
$tmpDir =
GHSA
OroPlatform vulnerable to path traversal during temporary file manipulations
ghsa·2023-11-27
CVE-2022-41951 [HIGH] CWE-22 OroPlatform vulnerable to path traversal during temporary file manipulations
OroPlatform vulnerable to path traversal during temporary file manipulations
### Impact
Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`.
With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. The file will be deleted immediately after the script ends.
### Workarounds
Apply patch
```patch
--- a/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
+++ b/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
@@ -614,6 +614,10 @@
*/
public function getTemporaryFileName(string $suggestedFileName = null): string
{
+ if ($suggestedFileName) {
+ $suggestedFileName = basename($suggestedFileName);
+ }
+
$tmpDir =
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-11-27
Published