CVE-2022-37865

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.

• CWE-22
• CWE-22

• https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdyMailing List, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/
• https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdyMailing List, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/

Published

Nov 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3785A vulnerability, which was classified as critical, has been …7.8
• CVE-2022-37857bilde2910 Hauk v1.6.1 requires a hardcoded password which by…7.5
• CVE-2022-3786A buffer overrun can be triggered in X.509 certificate verif…7.5
• CVE-2022-37860The web configuration interface of the TP-Link M7350 V3 with…9.8
• CVE-2022-37861There is a remote code execution (RCE) vulnerability in Tenh…9.8
• CVE-2022-37864A vulnerability has been identified in Solid Edge (All Versi…7.8
• CVE-2022-37866When Apache Ivy downloads artifacts from a repository it sto…7.5
• CVE-2022-3787A vulnerability was found in the device-mapper-multipath. Th…7.8
• CVE-2022-37877A vulnerability in the ClearPass OnGuard macOS agent could a…7.8
• CVE-2022-37878Vulnerabilities in the ClearPass Policy Manager web-based ma…7.2
• CVE-2022-37879Vulnerabilities in the ClearPass Policy Manager web-based ma…7.2
• CVE-2022-3788Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…