CVE-2022-4244

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-424423.3IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner CVE-2022-424439.8An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may alloCVE-2022-424446.5IBM App Connect Enterprise 11.0.0.8 through 11.0.0.19 and 12.0.1.0 through 12.0.5.0 is vulnerable to a buffer overflow. A remote privileged CVE-2022-424454.9HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential pCVE-2022-424466.5Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the CVE-2022-424478.8HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a lCVE-2022-424495.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicaCVE-2022-42454.3A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequenCVE-2022-424505.4Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-424514.4Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged usCVE-2022-424525.4HCL Launch is vulnerable to HTML injection.  HTML code is stored and included without being sanitized. This can lead to further attacks suchCVE-2022-424536.5There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the lo
CVE-2022-4244: High severity, CVSS 7.5 | Vulnix