← Back

CVE-2022-29281

nvd nist
Published: Apr 15, 2022Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program (or theft of NTLM credentials via an SMB relay attack, because the application resolves UNC paths).

Affected (9)

Products: Notable: Notable
Notable
1 product
Notable
Configuration A
9 vulnerable
Vulnerable SoftwareAffected Versions
Notable
Notable
Before 1.9.0
Notable
Version 1.9.0 beta0
Notable
Version 1.9.0 beta1
Notable
Version 1.9.0 beta2
Notable
Version 1.9.0 beta3
Notable
Version 1.9.0 beta4
Notable
Version 1.9.0 beta5
Notable
Version 1.9.0 beta6
Notable
Version 1.9.0 beta7

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory

Timeline

No history available yet.