CVE-2022-23457

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
OWASP ESAPI	org.owasp.esapi:esapi	>= 2.3.0.0, < 2.3.0.0

References

https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txtRelease Notes
https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230127-0014/Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2022-008_The_OWASP_Enterprise_Security_API/Exploit, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txtRelease Notes
https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00010.html
https://security.netapp.com/advisory/ntap-20230127-0014/Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2022-008_The_OWASP_Enterprise_Security_API/Exploit, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Apr 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234586.1Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting CVE-2022-234599.8Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memor CVE-2022-23464.3In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.CVE-2022-234607.5Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustio CVE-2022-234616.1Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attac CVE-2022-234627.5IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerabilit CVE-2022-234639.8Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver CVE-2022-234647.5Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceI CVE-2022-234657.8SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window CVE-2022-234665.4teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-sit CVE-2022-234674.6OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified CVE-2022-234689.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.