{"answers":{"affected":"2 open source packages ship an affected version, including org.codehaus.plexus:plexus-utils. It affects 2 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4244 exists.","fix":"Upgrade org.codehaus.plexus:plexus-utils to 3.0.24 or later.","what":"CVE-2022-4244 is a high-severity path traversal vulnerability in Red Hat A-MQ Clients 2, published on 25 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-4244 and fix it if it is affected.\n\nWhat it is: CVE-2022-4244 is a high-severity path traversal vulnerability in Red Hat A-MQ Clients 2, published on 25 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4244 exists.\n\nAffected packages and fixed versions:\n- org.codehaus.plexus:plexus-utils (Maven): affected all versions; fixed in 3.0.24\n- org.codehaus.plexus:plexus-utils (Maven): affected all versions; fixed in 3.0.24\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-4244/ (Markdown: https://insights.sbomify.com/CVE-2022-4244/index.md)","id":"CVE-2022-4244","markdown":"https://insights.sbomify.com/CVE-2022-4244/index.md","name":"CVE-2022-4244","record":{"aliases":["CLSA-2025-1765325274","DEBIAN-CVE-2022-4244","GHSA-g6ph-x5wf-g337","UBUNTU-CVE-2022-4244"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Java library","requires_auth":"none","summary":"Attackers can access arbitrary files outside the intended directory via path traversal in the Codehaus Plexus library.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"plexus-utils","vendor":"codehaus-plexus"},{"product":"integration_camel_k","vendor":"redhat"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":"2025-08-22","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-08-22T03:19:49Z","kind":"github_poc","ref":"https://github.com/shoucheng3/codehaus-plexus__plexus-utils_CVE-2022-4244_3-0-23","stars":0,"title":null}],"tier":"weaponised"},"has_fix":true,"headline":"Codehaus-plexus: directory traversal","id":"CVE-2022-4244","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"path_traversal","year":"2022"},"n_packages":2,"n_references":4,"next":{"headline":"Codehaus-plexus: xml external entity (xxe) injection","id":"CVE-2022-4245"},"packages":[{"ecosystem":"Maven","fixed":["3.0.24"],"introduced":["0"],"last_affected":[],"package":"org.codehaus.plexus:plexus-utils","purl":null,"source":"GHSA-g6ph-x5wf-g337"},{"ecosystem":"Maven","fixed":["3.0.24"],"introduced":["0"],"last_affected":[],"package":"org.codehaus.plexus:plexus-utils","purl":"pkg:maven/org.codehaus.plexus/plexus-utils","source":"GHSA-g6ph-x5wf-g337"}],"prev":{"headline":"ImageInject \u003c= 1.17 - Admin+ Stored XSS","id":"CVE-2022-4243"},"products":["A-MQ Clients 2","RHINT Camel-K-1.10.1","RHPAM 7.13.1 async","Red Hat A-MQ Online","Red Hat Data Grid 8","Red Hat Decision Manager 7","Red Hat Enterprise Linux 7","Red Hat Enterprise Linux 8","Red Hat Enterprise Linux 9","Red Hat Integration Camel Quarkus","Red Hat Integration Change Data Capture","Red Hat Integration Service Registry","Red Hat JBoss A-MQ 7","Red Hat JBoss Data Grid 7","Red Hat JBoss Enterprise Application Platform 6","Red Hat JBoss Enterprise Application Platform 7","Red Hat JBoss Enterprise Application Platform Expansion Pack","Red Hat JBoss Fuse 6","Red Hat JBoss Fuse 7","Red Hat JBoss Fuse Service Works 6","Red Hat JBoss Web Server 3","Red Hat JBoss Web Server 5","Red Hat OpenShift Application Runtimes","Red Hat Process Automation 7","Red Hat Single Sign-On 7","Red Hat Software Collections","Red Hat build of Apache Camel for Spring Boot","Red Hat build of Quarkus","Red Hat support for Spring Boot"],"published":"2023-09-25","related":[{"cvss_score":9.8,"headline":"OS Command Injection in Plexus-utils","id":"CVE-2017-1000487","kev_date_added":null,"published":"2018-01-03"},{"cvss_score":8.8,"headline":"Plexus-Utils has a Directory Traversal vulnerability in its extractFile method","id":"CVE-2025-67030","kev_date_added":null,"published":"2026-03-25"},{"cvss_score":4.3,"headline":"Codehaus-plexus: xml external entity (xxe) injection","id":"CVE-2022-4245","kev_date_added":null,"published":"2023-09-25"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-03","vendors":["Red Hat"]},"summary":"Attackers can access arbitrary files outside the intended directory via path traversal in the Codehaus Plexus library.","url":"https://insights.sbomify.com/CVE-2022-4244/"}