CVE-2022-0072 - Directory Traversal in OpenLiteSpeed Web Server

Back Back to CVE browser

MEDIUM

Directory Traversal in OpenLiteSpeed Web Server

Published Oct 27, 2022

5.8

MEDIUM

CVSS 3.1

EPSS 0.99%

Description

Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1

Affected products

Vendor LiteSpeed Technologies Product LiteSpeed Web Server Default
unaffected
- Version
  1.5.11
  Status
  affected
  Constraints
  <=1.5.12
- Version
  1.6.5
  Status
  affected
  Constraints
  <=1.6.20.1
- Version
  1.7.0
  Status
  affected
  Constraints
  <1.7.16.1
Vendor LiteSpeed Technologies Product OpenLiteSpeed Web Server Default
unaffected
- Version
  1.5.11
  Status
  affected
  Constraints
  <=1.5.12
- Version
  1.6.5
  Status
  affected
  Constraints
  <=1.6.20.1
- Version
  1.7.0
  Status
  affected
  Constraints
  <1.7.16.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

LiteSpeed Technologies

LiteSpeed Web Server

unaffected

Version	Status	Constraints
1.5.11	affected	<=1.5.12
1.6.5	affected	<=1.6.20.1
1.7.0	affected	<1.7.16.1

LiteSpeed Technologies

OpenLiteSpeed Web Server

unaffected

Version	Status	Constraints
1.5.11	affected	<=1.5.12
1.6.5	affected	<=1.6.20.1
1.7.0	affected	<1.7.16.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15293
Advisory
https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061
ExploitThird Party Advisory
https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15293		Advisory
https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061		ExploitThird Party Advisory
https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061		ExploitThird Party Advisory