CVE-2022-25882: Path Traversal
Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25882?
CVE-2022-25882 is classified as a medium severity vulnerability due to its potential for directory traversal attacks.
How do I fix CVE-2022-25882?
To fix CVE-2022-25882, upgrade the onnx package to version 1.13.0 or later.
What versions of onnx are affected by CVE-2022-25882?
CVE-2022-25882 affects all versions of the onnx package before 1.13.0.
What type of attack does CVE-2022-25882 enable?
CVE-2022-25882 enables directory traversal attacks which can allow access to sensitive files outside the application’s directory.
Is CVE-2022-25882 specific to any operating system?
CVE-2022-25882 is not specific to any operating system; it affects the onnx package regardless of the platform.