CVE-2022-41951 OroPlatform vulnerable to path traversal during temporary file manipulations
Attackers can exploit path traversal in temporary file handling to write arbitrary content to new files during script execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41951?
CVE-2022-41951 is a high-severity path traversal vulnerability in oroinc platform, published on 27 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.
Weakness: CWE-22
Which versions are affected by CVE-2022-41951?
6 open source packages ship an affected version, including oro/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oro/platform Packagist | From 4.1.0 to 4.1.13 | None |
oro/platform Packagist | From 4.1.0 to 4.1.13 | None |
oro/platform Packagist | From 4.2.0 to 4.2.10 | None |
oro/platform Packagist | From 4.2.0 to 4.2.10 | None |
oro/platform Packagist | From 5.0.0 | 5.0.8 |
oro/platform Packagist | From 5.0.0 | 5.0.8 |
Products include Oroinc Oroplatform.
How do I fix CVE-2022-41951?
Upgrade oro/platform to 5.0.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-41951 being exploited?
There is no known exploitation of CVE-2022-41951 in the wild and no public exploit code.
Other vulnerabilities in oroinc platform
- CVE-2021-43852 JavaScript Prototype Pollution in oro/platform
- CVE-2021-41236 XSS vulnerability in oro/platform
- CVE-2024-50677 Cross-site scripting in n/a
- CVE-2023-32062 OroCalendarBundle has incorrect system calendar events visibility
- CVE-2023-45824 OroPlatform's pinned entity creation form shows pages of other users
Sources
Also known as GHSA-9v3j-4j64-p937.