Lucene search
Veracode Vulnerability DatabaseVERACODE:37832HistoryNov 08, 2022 - 3:35 a.m.
Arbitrary File Write
2022-11-0803:35:02
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
15
arbitrary file write
software
zippacking
vulnerability
absolute paths
0.001 Low
EPSS
Percentile
47.8%
apache ivy is vulnerable to arbitrary file write. The vulnerability exists due to the unpack function in ZipPacking.java not properly verifying the target path when extracting an artifact archive, allowing an attacker to write files to any location on the file system through the absolute paths or paths that try to traverse upwards using ... sequences.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache ivy | le | 2.5.0 | |
| apache ivy | le | 2.5.0 | |
| apache-ivy | eq | 2.3.0__4.el7 |
Related
redhatcve
redhatcve
CVE-2022-37865
2023-03-27 20:43:04
nvd
nvd
CVE-2022-37865
2022-11-07 11:15:10
prion
prion
Code injection
2022-11-07 11:15:00
cve
cve
CVE-2022-37865
2022-11-07 11:15:10
osv
osv
CVE-2022-37865
2022-11-07 11:15:10
Apache Ivy does not verify target path when extracting the archive
2022-11-07 12:00:33
github
github
Apache Ivy does not verify target path when extracting the archive
2022-11-07 12:00:33
cvelist
cvelist
CVE-2022-37865 Apache Ivy allows creating/overwriting any file on the system
2022-11-07 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: apache-ivy-2.5.1-3.fc38
2023-07-04 01:34:09
mageia
mageia
Updated apache-ivy packages fix security vulnerability
2023-07-07 08:54:45
ibm
ibm
nessus
nessus
Fedora 38 : apache-ivy (2023-35f775fd6e)
2023-07-04 00:00:00
RHEL 7 : apache-ivy (Unpatched Vulnerability)
2024-05-11 00:00:00
Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2023-174)
2023-05-03 00:00:00
openvas
openvas
Fedora: Security Advisory for apache-ivy (FEDORA-2023-35f775fd6e)
2023-07-05 00:00:00
Mageia: Security Advisory (MGASA-2023-0216)
2023-07-10 00:00:00
redhat
redhat
oracle
oracle
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
Oracle Critical Patch Update Advisory - April 2023
2023-04-18 00:00:00