vulnerability
Ubuntu: (CVE-2022-23457): libowasp-esapi-java vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Apr 25, 2022 | Apr 17, 2026 | Apr 17, 2026 |
Description
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
Solution
References
- CVE-2022-23457
- https://attackerkb.com/topics/CVE-2022-23457
- CWE-22
- EUVD-EUVD-2022-1678
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1678
- https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txt
- https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2
- https://securitylab.github.com/advisories/GHSL-2022-008_The_OWASP_Enterprise_Security_API/
- https://ubuntu.com/security/notices/USN-8181-1
- https://www.cve.org/CVERecord?id=CVE-2022-23457
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.