Path traversal in AWS SDK for Java - CVE-2022-31159

Vulnerability identifier: #VU73175

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31159

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the downloadDirectory() method in in the AWS S3 TransferManager component. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

AWS SDK for Java
IBM Process Mining
IBM Sterling B2B Integrator
Bamboo Server
Autodesk Infraworks
Netcool Operations Insight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Asset Management
IBM Spectrum Protect Storage Agent
Maximo Manage Application in IBM Maximo Application Suite
Cloudera Data Platform Private Cloud Base for IBM
IBM Qradar SIEM
Splunk Enterprise
IBM Security Guardium
IBM Disconnected Log Collector
Splunk AppDynamics Analytics Agent
IBM Cloud Pak for Watson AIOps
Storage Virtualize

Install update from vendor's website.

AWS SDK for Java - update to 1.12.261
IBM Process Mining - update to 1.13.1
IBM Sterling B2B Integrator - addressed in versions 6.0.3.8, 6.1.0.6, 6.1.1.3, 6.1.2.1
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
Bamboo Server - update to 9.2.9
Splunk Enterprise - addressed in versions 9.1.9, 9.2.6, 9.3.4, 9.4.2
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
Netcool Operations Insight - update to 1.6.8
IBM Disconnected Log Collector - update to 1.8.3
IBM Cloud Pak for Watson AIOps - update to 3.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.0
IBM Maximo Asset Management - addressed in versions 7.6.1.2.33, 7.6.1.3.7
IBM Spectrum Protect Storage Agent - update to 8.1.19
Maximo Manage Application in IBM Maximo Application Suite - update to 8.4.9
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Splunk AppDynamics Analytics Agent - update to 26.1.0

• https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3

• Path traversal in AWS SDK for Java
• Path traversal in IBM Security Guardium
• Multiple vulnerabilities in Autodesk InfraWorks
• Path traversal in IBM Maximo Manage application in IBM Maximo Application Suite
• Path traversal in IBM Maximo Asset Management
• Path traversal in IBM Storage Protect server
• Path traversal in IBM Watson Discovery for IBM Cloud Pak for Data
• Path traversal in IBM Process Mining
• Path traversal in IBM Sterling B2B Integrator
• Path traversal in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Storage Virtualize
• Bamboo Data Center and Server update for AWS SDK for Java
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Splunk AppDynamics Analytics Agent update for third-party components