CVE-2022-27043
Published: 15 April 2022
Summary
CVE-2022-27043 is a high-severity Path Traversal (CWE-22) vulnerability in Yearning Yearning. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Yearning versions 2.3.1 and 2.3.2 Interstellar GA as well as 2.3.4 through 2.3.6 Neptune contain a directory traversal vulnerability tracked as CVE-2022-27043. The issue is assigned CWE-22 and carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, no required privileges or user interaction, and high confidentiality impact with no integrity or availability effects.
An unauthenticated attacker can send crafted requests over the network to read arbitrary files outside the intended web root, exposing sensitive configuration data or source code from the affected Yearning deployments.
Public references consist of a GitHub repository that appears to contain proof-of-concept material. The associated EPSS score stands at 0.4473 for both current and peak values, indicating sustained moderate exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31583
Vulnerability details
Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.