CVE-2022-24774

    Dashboard / Vulnerabilities / CVE-2022-24774

    CVE-2022-24774

    Published: 22 Mar 2022Last Modified: 12 Aug 2026

    Summary: Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server

    Details: CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.

    References: https://github.com/CycloneDX/cyclonedx-bom-repo-server/releases/tag/v2.0.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24774.json, https://github.com/CycloneDX/cyclonedx-bom-repo-server/security/advisories/GHSA-6c74-9588-wq9j, https://nvd.nist.gov/vuln/detail/CVE-2022-24774, https://github.com/CycloneDX/cyclonedx-bom-repo-server/commit/001a3278b5572e52c0ecac0bd1157bf2599502b7

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -001a3278b5572e52c0ecac0bd1157bf2599502b7

    Affected versions

    v2.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24774 | CVE-DB