CVE-2022-2653

Published: Aug 4, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file in the system.

Affected (1)

Products: Planka: Planka

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Planka Planka	Before 1.5.1

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

https://github.com/plankanban/planka/commit/ac1df5201dfdaf68d37f7e1b272bc137870d7418

Source: security@huntr.dev

PatchThird Party Advisory

https://huntr.dev/bounties/5dff7cf9-8bb2-4f67-a02d-b94db5009d70

Source: security@huntr.dev

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/plankanban/planka/commit/ac1df5201dfdaf68d37f7e1b272bc137870d7418

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://huntr.dev/bounties/5dff7cf9-8bb2-4f67-a02d-b94db5009d70

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

Timeline

No history available yet.