CVE-2022-24774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24774
Aliases
  • GHSA-6c74-9588-wq9j
Published
2022-03-22T16:35:12Z
Modified
2026-04-02T07:50:08.925383Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
Details

CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the appsettings.json file, or alternatively, setting the environment variables ALLOWEDMETHODS__POST and ALLOWEDMETHODS__DELETE to false.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24774.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-35"
    ]
}
References

Affected packages

Git / github.com/cyclonedx/cyclonedx-bom-repo-server

Affected ranges

Type
GIT
Repo
https://github.com/cyclonedx/cyclonedx-bom-repo-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
001a3278b5572e52c0ecac0bd1157bf2599502b7

Affected versions

v0.*
v0.0.1
v0.1.0
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.2
v2.*
v2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24774.json"