NetApp ActiveIQ Unified Manager: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2022-23457 Public exploit

  Path Traversal in ESAPI

  ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the test…

  OWASP ESAPI org.owasp.esapi:esapi org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  Apr 25, 2022
• Medium 5.4
  CVE-2022-24891 Public exploit

  Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

  ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteUR…

  ESAPI esapi-java-legacy org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  Apr 27, 2022

Revision history

1. 2023-01-29 #1

   Initiale Fassung

References

• Netapp Security Advisory vom 2023-01-29
  https://security.netapp.com/advisory/ntap-20230127-0014/