CVE Feed

    Dashboard / CVE / CVE-2022-41951

    CVE-2022-41951

    OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.

    Published:Nov 27, 2023
    Last Modified:Nov 21, 2024
    EPS:Nov 27, 2023
    EPSS Score:0.00414
    CVSS Score:8.6

    Affected Products

    Vendor
    Oroinc
    Product
    Oroplatform

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-50677 (CVSS 6.1) — A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web s…
    CVE-2023-48296 (CVSS 4.3) — OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite naviga…
    CVE-2023-45824 (CVSS 4.3) — OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinn…
    CVE-2023-32062 (CVSS 5) — OroPlatform is a package that assists system and user calendar management. Back-office users can access inform…
    CVE-2021-43852 (CVSS 8.8) — OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted reques…
    CVE-2021-41236 (CVSS 6.9) — OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnera…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High