CVE-2022-25882
Assigner: snyk
Published: 2023-01-25T05:00:02.847Z
State: PUBLISHED
metrics: cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
credits: value: jnovikov
problemTypes: descriptions: cweId: CWE-22
description: Directory Traversal
descriptions: value: Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"
affected: product: onnx
versions: version: 0
lessThan: 1.13.0
status: affected
versionType: semver
vendor: n/a