Vulnerability Description
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oroinc | Oroplatform | < 5.0.9 |
Related Weaknesses (CWE)
References
- https://github.com/oroinc/platform/security/advisories/GHSA-9v3j-4j64-p937PatchVendor Advisory
- https://github.com/oroinc/platform/security/advisories/GHSA-9v3j-4j64-p937PatchVendor Advisory
FAQ
What is CVE-2022-41951?
CVE-2022-41951 is a vulnerability with a CVSS score of 8.5 (HIGH). OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileM...
How severe is CVE-2022-41951?
CVE-2022-41951 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-41951?
Check the references section above for vendor advisories and patch information. Affected products include: Oroinc Oroplatform.