CVE-2022-23457
Description
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
How to fix
- owasp enterprise_security_api2.3.0.0 or later
- org.owasp.esapi:esapi2.3.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| owasp enterprise_security_api | v < 2.3.0.0 | 2.3.0.0 |
| oracle weblogic_server | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| org.owasp.esapi:esapiMaven | v < 2.3.0.0 | 2.3.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.