CVE-2022-46171

HIGH Year: 2022
CVSS v3 Score
7.7
High
Weakness Type
CWE-22
View all →

Vulnerability Description

Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.

Related Vulnerabilities

CVE-2017-2829

HIGH
CVSS:7.7(High)

An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request ...

CWE-222017

CVE-2018-5430

HIGH
CVSS:7.7(High)

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with M...

CWE-222018

CVE-2020-12102

HIGH
CVSS:7.7(High)

In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the fil...

CWE-222020

CVE-2020-12103

HIGH
CVSS:7.7(High)

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope...

CWE-222020

CVE-2020-13550

HIGH
CVSS:7.7(High)

A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can se...

CWE-222020

CVE-2020-16136

HIGH
CVSS:7.7(High)

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory tr...

CWE-222020