CVE-2022-31506: Path Traversal
Published Jul 11, 2022
·Updated
The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely.
Affected Software
2 affected components
pip/opendiamond<=10.1.1
cmu opendiamond<=10.1.1
Remediation
Event History
Jul 11, 2022
CVE Published
via MITRE·12:54 AM
Data Sourced
via MITRE·12:54 AM
Description
Jul 12, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2022-31506?
CVE-2022-31506 is rated as a medium severity vulnerability due to its potential for unauthorized file access.
2
How do I fix CVE-2022-31506?
To fix CVE-2022-31506, update to version 10.1.2 or later of the cmusatyalab/opendiamond software.
3
What systems are affected by CVE-2022-31506?
CVE-2022-31506 affects versions of the cmusatyalab/opendiamond software up to and including 10.1.1.
4
What is absolute path traversal in CVE-2022-31506?
Absolute path traversal in CVE-2022-31506 allows attackers to access files outside the intended directory.
5
Is CVE-2022-31506 an open source vulnerability?
Yes, CVE-2022-31506 is a vulnerability found in the open source cmusatyalab/opendiamond repository on GitHub.