CVE-2022-4494 bspkrs MCPMappingViewer ZIP File RemoteZipHandler.java extractZip path traversal
A path traversal vulnerability in MCPMappingViewer allows remote attackers to read or modify arbitrary files via crafted ZIP archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-4494?
CVE-2022-4494 is a medium-severity path traversal vulnerability in bspkrs MCPMappingViewer, published on 14 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src/main/java/bspkrs/mmv/RemoteZipHandler.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The name of the patch is 6e602746c96b4756c271d080dae7d22ad804a1bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215804.
Weakness: CWE-22
Which versions are affected by CVE-2022-4494?
It affects 1 product.
Products include Mcp Mapping Viewer Project Mcp Mapping Viewer.
How do I fix CVE-2022-4494?
No fix has been published for CVE-2022-4494 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-4494 being exploited?
There is no known exploitation of CVE-2022-4494 in the wild and no public exploit code.
Sources
Also known as GHSA-qcqq-65g4-h9xj.