CVE-2022-27906

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/Technical Description, Third Party Advisory
https://mendelson-e-c.com/node/3355Release Notes, Vendor Advisory
https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/Technical Description, Third Party Advisory
https://mendelson-e-c.com/node/3355Release Notes, Vendor Advisory

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-279074.3Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.CVE-2022-279088.8Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.CVE-2022-279094.3In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other use CVE-2022-27917.8Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, CVE-2022-279106.1In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) i CVE-2022-279115.3An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 change CVE-2022-279125.3An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.CVE-2022-279136.1An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vuln CVE-2022-279146.1An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vuln CVE-2022-279199.8Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The CVE-2022-27927.5Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data CVE-2022-279206.1libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.