CVE-2022-4773

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	cloudsync	n/a

References

https://github.com/HolgerHees/cloudsync/commit/3ad796833398af257c28e0ebeade68518e0e612aExploit, Patch, Third Party Advisory
https://vuldb.com/?ctiid.216919Permissions Required, Third Party Advisory
https://vuldb.com/?id.216919Permissions Required, Third Party Advisory
https://github.com/HolgerHees/cloudsync/commit/3ad796833398af257c28e0ebeade68518e0e612aExploit, Patch, Third Party Advisory
https://vuldb.com/?ctiid.216919Permissions Required, Third Party Advisory
https://vuldb.com/?id.216919Permissions Required, Third Party Advisory

Timeline

Published: Dec 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-477327.5In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing ad CVE-2022-47749.8The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated CVE-2022-477409.8Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.CVE-2022-477458.8ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a s CVE-2022-477477.5kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.CVE-2022-47755.4The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-477579.8In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into CVE-2022-477589.8Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.CVE-2022-47765.4The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-477627.5In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.CVE-2022-477668.8PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.CVE-2022-477679.8A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This af