Codehaus-plexus: directory traversal
Priority HIGH 72CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 17 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01347 71st percentileScored 2026-11-07
Fix Partial org.codehaus.plexus:plexus-utils (Maven): 3.0.24Red Hat: 2 advisoriesRed Hat: 2 fixed, 17 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | RHINT Camel-K-1.10.1 | — | — | Not affected | CNA |
| Red Hat | RHPAM 7.13.1 async | — | — | Not affected | CNA |
| Red Hat | A-MQ Clients 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat A-MQ Online | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | No fix listed | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Decision Manager 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel Quarkus | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Change Data Capture | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Service Registry | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss A-MQ 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Web Server 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Web Server 5 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Application Runtimes | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat support for Spring Boot | — | — | No fix listed | CNA |
| — | org.codehaus.plexus:plexus-utils (Maven) | before 3.0.24 | 3.0.24 | Patch available | GHSA-g6ph-x5wf-g337 |
- RHINT Camel-K-1.10.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- RHPAM 7.13.1 async VendorRed Hat Affected — Fixed in — Not affected CNA
- A-MQ Clients 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat A-MQ Online VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apache Camel for Spring Boot VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Change Data Capture VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Service Registry VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss A-MQ 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse Service Works 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Web Server 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Web Server 5 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Application Runtimes VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat support for Spring Boot VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.codehaus.plexus:plexus-utils (Maven) Vendor— Affected before 3.0.24 Fixed in 3.0.24 Patch available GHSA-g6ph-x5wf-g337
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* | before 3.0.24 | Vulnerable | codehaus-plexus |
| cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:* | before 1.10.1 | Vulnerable | Red Hat |
- cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* Versions before 3.0.24 Vulnerable ·codehaus-plexus
- cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:* Versions before 1.10.1 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-g6ph-x5wf-g337 org.codehaus.plexus:plexus-utils (Maven) Fixed in 3.0.24 Advisory →
Red Hat 2 advisories
- RHSA-2023:3906 Released 2023-06-28 · Red Hat rating ImportantRed Hat Integration Camel K 1.10.1 release security update
- RHINT Camel-K-1.10.1
- RHSA-2023:2135 Released 2023-05-04 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.3 security update
- RHPAM 7.13.1 async
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat A-MQ Clients 2, RHINT Camel-K-1.10.1 and 27 more products — RHSA-2023:3906
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2022-03886 Codehaus-plexus: xml external entity (xxe) injectionPriority LOW 21
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Debezium 1 | Affected | No fix planned: Will not fix |
| Red Hat support for Spring Boot | Affected | No fix planned: Will not fix |
| RHINT Camel-K-1.10.1 | Fixed | RHSA-2023:3906 |
| RHPAM 7.13.1 async | Fixed | RHSA-2023:2135 |
Not affected: 11 products
- A-MQ Clients 2
- Red Hat A-MQ Online
- Red Hat AMQ Broker 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Web Server 5
- Red Hat OpenShift Application Runtimes
- Red Hat Single Sign-On 7
- Red Hat Software Collections
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4244
- 2026-10-03 Alias added: GHSA-g6ph-x5wf-g337
References
Advisory 5
More Red Hat Integration Camel K vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
- TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
- TI-2022-04106 Server-side request forgery in undertow CVSS 3.1HIGH 7.5
- TI-2024-07308 Undertow: improper state management in proxy protocol parsing causes information leakage CVSS 3.1HIGH 7.5
- TI-2023-01048 Undertow: infinite loop in sslconduit during close CVSS 3.1HIGH 7.5
Sources
- CVE-2022-4244 · CVE Program
- CVE-2022-4244 · NVD
- FIRST EPSS
- GHSA-g6ph-x5wf-g337 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-4244 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences