CVE-2022-22932

Path traversal flaws

MEDIUM

5.3

CVSS Score

Published: January 26, 2022 at 11:10 AM UTC

Updated: June 17, 2026 at 04:29 AM UTC

1 product affected across 1 vendorKaraf

Using Apache Karaf by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Karaf - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 3%

Description

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Karaf · Apachemaven

95%

v < 4.2.154.3.0 ≤ v < 4.3.6Apache Karaf ≤ v < 4.2.15

Affected range stops below 4.2.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://karaf.apache.org/security/cve-2022-22932.txt

References (1)

x_refsource_MISCVendor Advisory

Source: [email protected]

https://karaf.apache.org/security/cve-2022-22932.txt

CVSS

5.3MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: LOW
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card