High severity · published Dec 17, 2022
CVE-2022-4572
A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0
7.1
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
Ubi Reader · Ubi Reader Project
through 0.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4572
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4572
Patch
https://github.com/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f579ae9139
Issue Tracking
https://github.com/jrspruitt/ubi_reader/pull/57
Release Notes
https://github.com/jrspruitt/ubi_reader/releases/tag/v0.8.5-master
Third Party Advisory
https://vuldb.com/?id.216146
More from Ubi Reader
5.5
CVE-2023-0591
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction…