Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
WebLogic Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability - CVE-2022-23457 - Vulnerability Database
WebLogic

WebLogic Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability - CVE-2022-23457

Critical
Reference: CVE-2022-23457
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-23457
Title: WebLogic Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability
Overview:

ESAPI (The OWASP Enterprise Security API) is a free open source web application security control library. Prior to version 2.3.0.0 the default implementation of Validator.getValidDirectoryPath(String String File boolean) may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 39input39 path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround it is possible to write one39s own implementation of the Validator interface. However maintainers do not recommend this.