CVE-2022-38794
Published: 27 August 2022
Summary
CVE-2022-38794 is a high-severity Path Traversal (CWE-22) vulnerability in Zaver Project Zaver. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Zaver through version 2020-12-15 contains a directory traversal vulnerability tracked as CVE-2022-38794 and assigned CWE-22. The flaw permits an unauthenticated remote attacker to supply a GET request containing the substring /.. and thereby access files outside the intended web root. It carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, and high impact on confidentiality.
An attacker with network access can exploit the issue without credentials or user interaction to read arbitrary files on the server, potentially exposing configuration data, source code, or other sensitive material. The EPSS score stands at 0.4901 with an identical recorded peak, indicating sustained but not sharply increasing exploitation interest since disclosure.
The referenced GitHub issue provides the sole public technical discussion of the flaw; no vendor advisory or patch information appears in the supplied references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-41356
Vulnerability details
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.