CVE-2022-24774 is an improper input validation vulnerability in CycloneDX BOM Repository Server versions prior to 2.0.1, allowing for path traversal. This flaw enables a malicious authenticated user to create arbitrary directories or cause a denial of service by deleting them. Rated 8.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it can be exploited remotely with low complexity and user privileges, leading to high impact on integrity and availability. While not actively exploited or listed in KEV, and lacking public exploit code or significant community discussion, the vulnerability is not exploitable in the default configuration where POST and DELETE methods are disabled.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.0.1CPE matchmatch criteria | cpe:2.3:a:cyclonedx:bill_of_materials_repository_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.