CVE-2022-4878 JATOS ZIP ZipUtil.java ZipUtil path traversal

Medium 5.5 Published 6 Jan 2023 Updated 3 Aug 2024

Attackers can exploit a path traversal vulnerability in JATOS to read or modify files outside the intended directory.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-4878?

CVE-2022-4878 is a medium-severity path traversal vulnerability in JATOS, published on 6 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.

Weakness: CWE-22

Which versions are affected by CVE-2022-4878?

It affects 1 product.

Products include Jatos Jatos.

How do I fix CVE-2022-4878?

No fix has been published for CVE-2022-4878 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-4878 being exploited?

There is no known exploitation of CVE-2022-4878 in the wild and no public exploit code.

Sources

Also known as GHSA-mr22-3rrp-47cx.