CVE-2022-24424

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-244267.8Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced D CVE-2022-244288.8Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A re CVE-2022-244297.8The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker ca CVE-2022-24438.8The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due t CVE-2022-244319.8All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitizat CVE-2022-244325.4Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScrip CVE-2022-244339.8The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, hand CVE-2022-244347.5This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attack CVE-2022-244356.1Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script vi CVE-2022-244366.5Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable info CVE-2022-244379.8The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is a CVE-2022-244399.8All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possib