Path Traversal Vulnerability in PureStorage OpenConnect Repository
CVE-2022-31524

9.3CRITICAL

Key Information:

Vendor

Purestorage

Status
Pure Swagger
Vendor
CVE Published:
11 July 2022

What is CVE-2022-31524?

The PureStorage OpenConnect repository, particularly versions up to 1.1.5, is susceptible to a path traversal vulnerability due to improper usage of the Flask send_file function. This can allow unauthorized access to the file system, enabling attackers to potentially access sensitive files beyond the application’s intended directory. Proper sanitization and validation measures should be implemented to mitigate this risk.

References

https://github.com/github/securitylab/issues/669#issuecom...
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.