CVE-2022-22731

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause path traversal attacks. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Schneider Electric	EcoStruxure Power Commission	>= All, < V2.22

References

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-227327.5A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supp CVE-2022-227336.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has g CVE-2022-227346.1The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and esca CVE-2022-227358.8The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lack CVE-2022-227367.0If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory CVE-2022-227377.5Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-aft CVE-2022-227388.8Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially CVE-2022-227396.5Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affect CVE-2022-22749.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This is CVE-2022-227408.8Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causi CVE-2022-227417.5When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability af CVE-2022-227426.5When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable cra