CVE-2022-4244
| Affected software | 2 products, listed below |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 3.0.24 |
| Weakness | Path traversal (CWE-22) |
| Published | 25 Sep 2023 |
| Updated | 17 Jun 2026 |
Description
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: yes, technical impact: partial.
- Indexed PoC none indexed
- EPSS 1.3% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Path traversal
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR path-traversal security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-22: Path Traversal. |
| Candidate fix | https://bugzilla.redhat.com/show_bug.cgi?id=2149841 : a Red Hat bug: the triage, which links onward to the fix |
How to mitigate CVE-2022-4244
Upgrade the affected software to 3.0.24 or later. Until you can, Waratek RASP blocks exploitation with its path traversal rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
secalert@redhat.com | Secondary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.codehaus.plexus:plexus-utils |
0 | 3.0.24 |
unbounded |
Products and versions
3 products, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | codehaus-plexus | plexus-utils | generic | ＜ 3.0.24 |
| osv | org.codehaus.plexus | plexus-utils | generic | ＜ 3.0.24 |
| nvd | redhat | integration camel k | generic | ＜ 1.10.1 |
References
Timeline
Timeline
| Published | 2023-09-25 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |