CVE-2022-25297

Published: Feb 21, 2022Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.

Affected (1)

Products: Drogon: Drogon

Drogon

1 product

Drogon

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Drogon Drogon	Before 1.7.5

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (6)

https://github.com/drogonframework/drogon/commit/3c785326c63a34aa1799a639ae185bc9453cb447

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/drogonframework/drogon/pull/1174

Source: report@snyk.io

ExploitPatchThird Party Advisory

https://snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-2407243

Source: report@snyk.io

ExploitPatchThird Party Advisory

https://github.com/drogonframework/drogon/commit/3c785326c63a34aa1799a639ae185bc9453cb447

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/drogonframework/drogon/pull/1174

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

https://snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-2407243

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.