Strix
26.1K

CVE-2022-38731

MEDIUMCVSS 4.3/10EPSS 0.73%

Last modified

CVE-2022-38731 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. EPSS estimates a 0.73% chance of exploitation in the next 30 days.

Description

Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.

Metrics

CVSS 3.1
4.3/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
0.73%

49.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
QaelumDose>= 18.08, < 21.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-38731?
Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.
How severe is CVE-2022-38731?
CVE-2022-38731 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 0.73% probability of exploitation in the next 30 days.
How do I fix CVE-2022-38731?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-38731?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST