high8.6
CVE-2022-38723
Gravitee API Management contains Path Traversal
Impact
**This CVE addresses the partial fix for CVE-2019-25075** Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary files via a /management/users/register request. A patch was published in 2019 for this vulnerability but did not appear to have solved the issue. Version 3.15.13 did remove the flaw.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.gravitee.apim:gravitee-api-management | < 3.15.13 | 3.15.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gravitee | Api Management | before 3.15.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://community.gravitee.io/t/whats-new-in-access-management-3-15-lts/164
- https://gist.github.com/garatc/d86cdb1fa2e35a7ee719d9a0de0b5ca3
- https://github.com/advisories/GHSA-vp62-m958-qj8c
- https://nvd.nist.gov/vuln/detail/CVE-2022-38723
- https://github.com/advisories/GHSA-xc4w-28g8-vqm5