CVE-2022-3969 - OpenKM FileUtils.java getFileExtension temp file

Back Back to CVE browser

MEDIUM

OpenKM FileUtils.java getFileExtension temp file

Published Nov 13, 2022

5.5

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.

Affected products

Vendor n/a Product OpenKM Default
n/a
- Version
  6.3.0
  Status
  affected
  Constraints
  -
- Version
  6.3.1
  Status
  affected
  Constraints
  -
- Version
  6.3.10
  Status
  affected
  Constraints
  -
- Version
  6.3.11
  Status
  affected
  Constraints
  -
- Version
  6.3.2
  Status
  affected
  Constraints
  -
- Version
  6.3.3
  Status
  affected
  Constraints
  -
- Version
  6.3.4
  Status
  affected
  Constraints
  -
- Version
  6.3.5
  Status
  affected
  Constraints
  -
- Version
  6.3.6
  Status
  affected
  Constraints
  -
- Version
  6.3.7
  Status
  affected
  Constraints
  -
- Version
  6.3.8
  Status
  affected
  Constraints
  -
- Version
  6.3.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

OpenKM

n/a

Version	Status	Constraints
6.3.0	affected	-
6.3.1	affected	-
6.3.10	affected	-
6.3.11	affected	-
6.3.2	affected	-
6.3.3	affected	-
6.3.4	affected	-
6.3.5	affected	-
6.3.6	affected	-
6.3.7	affected	-
6.3.8	affected	-
6.3.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-377

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43301
Advisory
https://github.com/openkm/document-management-system/commit/c069e4d73ab8864345c25119d8459495f45453e1
PatchThird Party Advisory
https://github.com/openkm/document-management-system/pull/332
ExploitPatchThird Party Advisory
https://github.com/openkm/document-management-system/releases/tag/v6.3.12
Release NotesThird Party Advisory
https://vuldb.com/?id.213548
Permissions RequiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43301		Advisory
https://github.com/openkm/document-management-system/commit/c069e4d73ab8864345c25119d8459495f45453e1		PatchThird Party Advisory
https://github.com/openkm/document-management-system/pull/332		ExploitPatchThird Party Advisory
https://github.com/openkm/document-management-system/releases/tag/v6.3.12		Release NotesThird Party Advisory
https://vuldb.com/?id.213548		Permissions RequiredThird Party Advisory