CVE-2022-4493

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Dec 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-449309.8D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.CVE-2022-449317.5Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.CVE-2022-449327.5An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.CVE-2022-449376.5Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.CVE-2022-449389.8Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.CVE-2022-449397.8Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vuCVE-2022-44949.8A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractCVE-2022-449409.1Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.CVE-2022-449428.1Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.CVE-2022-449445.4Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.phCVE-2022-449459.8Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.CVE-2022-449465.4Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module
CVE-2022-4493: Critical severity, CVSS 9.8 | Vulnix