Read the docs
TI-2022-07113 Aliases CVE-2022-22932GHSA-544x-2jx9-4pfg

Path traversal flaws

Priority LOW 29CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326

Why it matters now

EPSS 0.02753 86th percentileScored 2026-11-07
Fix Partial Apache Karaf (Apache Software Foundation): 4.2.15org.apache.karaf:apache-karaf (Maven): 4.3.6, 4.2.15Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache KarafApache Karaf to before 4.2.154.2.15Patch availableCNA
—org.apache.karaf:apache-karaf (Maven)4.3.0 to before 4.3.64.3.6Patch availableGHSA-544x-2jx9-4pfg
—org.apache.karaf:apache-karaf (Maven)before 4.2.154.2.15Patch availableGHSA-544x-2jx9-4pfg
  • Apache Karaf VendorApache Affected Apache Karaf to before 4.2.15 Fixed in 4.2.15 Patch available CNA
  • org.apache.karaf:apache-karaf (Maven) Vendor— Affected 4.3.0 to before 4.3.6 Fixed in 4.3.6 Patch available GHSA-544x-2jx9-4pfg
  • org.apache.karaf:apache-karaf (Maven) Vendor— Affected before 4.2.15 Fixed in 4.2.15 Patch available GHSA-544x-2jx9-4pfg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*before 4.2.15; 4.3.0 to before 4.3.6VulnerableApache
  • cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:* Versions before 4.2.15; 4.3.0 to before 4.3.6 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Karaf (Apache Software Foundation) Fixed in 4.2.15
  • Fix · GHSA-544x-2jx9-4pfg org.apache.karaf:apache-karaf (Maven) Fixed in 4.3.6 Advisory →
  • Fix · GHSA-544x-2jx9-4pfg org.apache.karaf:apache-karaf (Maven) Fixed in 4.2.15 Advisory →

Red Hat 1 advisory

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Not affected: 4 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22932
  2. 2026-10-03 Alias added: GHSA-544x-2jx9-4pfg

References

Advisory 2

Other 5

  • TI-2022-19035 Apache Karaf: JDBC JAAS LDAP injection CVSS 3.1CRITICAL 9.8
  • TI-2018-08445 XML external entity injection in Apache Karaf CVSS 3.0CRITICAL 9.8
  • TI-2026-61863 Missing authorization in Apache Karaf CVSS 3.1CRITICAL 9.8
  • TI-2026-61851 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2020-17076 An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. CVSS 3.1HIGH 8.1
  • TI-2026-61846 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences