CVE-2022-45184: Path Traversal
The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a remote attacker with administrator privilege to create, delete, update, and display files outside of the configuration directory via a crafted HTTP request to particular endpoints in the web server. Patched Versions are 3.5.3 and 3.4.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ironman Software PowerShell Universal Web Serverto a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Ironman Software PowerShell Universal Web Serverto a version that resolves this vulnerability.Fixed in 3.4.7
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-45184.
What is the severity of CVE-2022-45184?
The severity of CVE-2022-45184 is high with a severity value of 7.2.
Which version of Ironman Software PowerShell Universal is affected by this vulnerability?
Ironman Software PowerShell Universal v3.x and v2.x versions between 3.0.0 and 3.4.7, and versions between 3.5.0 and 3.5.3 are affected by this vulnerability.
How does this vulnerability allow directory traversal?
This vulnerability allows for directory traversal outside of the configuration directory, enabling a remote attacker with administrator privilege to create, delete, update, and display files outside of the configuration directory.
Are there any references available for this vulnerability?
Yes, there are references available for this vulnerability. You can refer to the following links: [https://blog.ironmansoftware.com/psu-2022-11-cve/](https://blog.ironmansoftware.com/psu-2022-11-cve/), [https://docs.powershelluniversal.com/changelog](https://docs.powershelluniversal.com/changelog), [https://ironmansoftware.com](https://ironmansoftware.com).