CVE-2022-42725

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2022/10/24/1Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/26/1
https://github.com/linuxmint/warpinator/commit/5244c33d4c109ede9607b9d94461650410e2cddcPatch, Third Party Advisory
https://github.com/linuxmint/warpinator/commit/8bfd2f8b3f1b0c0f0a5a6d275702d107b9e08a94Patch, Third Party Advisory
https://github.com/linuxmint/warpinator/commit/95124fd4468683dd69ddd7b3da0e9906ce6beae2Patch, Third Party Advisory
https://github.com/linuxmint/warpinator/commit/f4907ef6a17a189d56ab0a9da4b53190b061ad75Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/24/1Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/26/1
https://github.com/linuxmint/warpinator/commit/5244c33d4c109ede9607b9d94461650410e2cddcPatch, Third Party Advisory
https://github.com/linuxmint/warpinator/commit/8bfd2f8b3f1b0c0f0a5a6d275702d107b9e08a94Patch, Third Party Advisory
https://github.com/linuxmint/warpinator/commit/95124fd4468683dd69ddd7b3da0e9906ce6beae2Patch, Third Party Advisory
https://github.com/linuxmint/warpinator/commit/f4907ef6a17a189d56ab0a9da4b53190b061ad75Patch, Third Party Advisory

Timeline

Published: Oct 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-42739.8A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects CVE-2022-427317.5mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a u CVE-2022-427327.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427337.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427347.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427358.8Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level admin CVE-2022-42749.8A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-prope CVE-2022-427435.3deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the applicati CVE-2022-427449.8CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the ap CVE-2022-427457.5CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vul CVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is