Sign in Sign up
JA · EN · FR
SecPulse

Cwe 22

🧬 CWE Related 2,773
slug: cwe-22

Explanation

CWE-22は「ファイル名のパスをユーザー入力から組み立てるとき、`../` のような相対パス記号をきちんと無害化せず、本来アクセスできないファイルを読み書きされてしまう欠陥」のことです。 ファイルダウンロード機能・画像表示機能・テンプレート機能でよく見られます。 対策は「絶対パスへの正規化 + 許可されたディレクトリ内かのチェック」、または「ファイル名にIDのみを使い、パス記号を一切使わない設計」。
📌 Example
CVE-2024-57726 (SimpleHelp): zipファイル展開時のZip Slip攻撃で、サーバー上の任意の場所にファイル書き込みされる脆弱性。CISA KEV入り。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,773

Image ID Title
CVE-2021-41773 KEV [KEV] Path Traversal in Apache Http Server (CVE-2021-41773)
CVE-2021-20090 KEV [KEV] Path Traversal in Arcadyan Buffalo Firmware (CVE-2021-20090)
CVE-2019-3398 KEV [KEV] Path Traversal in Atlassian Confluence Server and Data Center (CVE-2019-3398)
CVE-2019-3396 KEV [KEV] Path Traversal in Atlassian Confluence Server and Data Server (CVE-2019-3396)
CVE-2020-3452 KEV [KEV] Vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2020-3452)
CVE-2018-0296 KEV [KEV] Vulnerability in Cisco Adaptive Security Appliance (ASA) (CVE-2018-0296)
CVE-2019-19781 KEV [KEV] Path Traversal in Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (CVE-2019-19781)
CVE-2020-5902 KEV [KEV] Path Traversal in F5 BIG-IP (CVE-2020-5902)
CVE-2018-13379 KEV [KEV] Path Traversal in Fortinet FortiOS (CVE-2018-13379)
CVE-2020-4430 KEV [KEV] Path Traversal in IBM Data Risk Manager (CVE-2020-4430)
CVE-2021-40444 KEV [KEV] Path Traversal in Microsoft MSHTML (CVE-2021-40444)
CVE-2021-27065 KEV [KEV] Path Traversal in Microsoft Exchange Server (CVE-2021-27065)
CVE-2019-11510 KEV [KEV] Path Traversal in Ivanti Pulse Connect Secure (CVE-2019-11510)
CVE-2020-11652 KEV [KEV] Path Traversal in Saltstack salt (CVE-2020-11652)
CVE-2018-2380 KEV [KEV] Path Traversal in SAP Customer Relationship Management (CRM) (CVE-2018-2380)
CVE-2016-3976 KEV [KEV] Path Traversal in SAP NetWeaver (CVE-2016-3976)
CVE-2021-20023 KEV [KEV] Path Traversal in SonicWall Email Security (CVE-2021-20023)
CVE-2019-18187 KEV [KEV] Path Traversal in Trend Micro OfficeScan (CVE-2019-18187)
CVE-2021-36741 KEV [KEV] Path Traversal in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security (CVE-2021-36741)
CVE-2019-20085 KEV [KEV] Path Traversal in TVT NVMS-1000 (CVE-2019-20085)
CVE-2021-21972 KEV [KEV] Vulnerability in VMware vCenter Server (CVE-2021-21972)
CVE-2020-11738 KEV [KEV] Path Traversal in WordPress Snap Creek Duplicator Plugin (CVE-2020-11738)
CVE-2021-34762 Path Traversal in Cisco Firepower Management Center (FMC) Software (CVE-2021-34762)
CVE-2021-29006 Path Traversal in Rconfig (CVE-2021-29006)
CVE-2021-1256 Vulnerability in Cisco Firepower Threat Defense (FTD) Software (CVE-2021-1256)
CVE-2021-29425 Vulnerability in Apache Weblogic Server (CVE-2021-29425)
CVE-2021-3199 KEV [KEV] Path Traversal in ONLYOFFICE Document Server (CVE-2021-3199)
CVE-2017-15684 Path Traversal in Crafter CMS Crafter Studio (CVE-2017-15684)
CVE-2017-15681 Path Traversal in Crafter CMS Crafter Studio (CVE-2017-15681)
CVE-2020-3550 Path Traversal in Cisco Firepower Management Center (FMC) Software (CVE-2020-3550)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details