Skip to main content

Safe CVE-2022-38340

HIGH
Path Traversal (CWE-22)
2022-09-20 cve@mitre.org
Path Traversal Safe Fme Server
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 20, 2022 - 18:15 nvd
HIGH 7.2

DescriptionNVD

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.

AnalysisAI

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload. Affected products include: Safe Fme Server.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Safe

View all
CVE-2020-14978 HIGH POC
8.1 Jun 23

An issue was discovered in F-Secure SAFE 17.7 on macOS. Rated high severity (CVSS 8.1), this vulnerability is remotely e
CVE-2020-14977 HIGH POC
8.1 Jun 23

An issue was discovered in F-Secure SAFE 17.7 on macOS. Rated high severity (CVSS 8.1), this vulnerability is remotely e
CVE-2025-25595 CRITICAL
9.8 Mar 18

A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a bru
CVE-2022-28872 HIGH
8.8 May 12

A vulnerability affecting F-Secure SAFE browser was discovered. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2018-20402 HIGH
8.8 Dec 23

Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial adminis
CVE-2023-35801 HIGH
8.1 Jun 23

A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation

CVE-2019-11644 HIGH
7.8 May 17

In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Ant
CVE-2023-2904 HIGH
7.3 Jun 07

The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within we
CVE-2022-38341 HIGH
7.1 Sep 19

Safe Software FME Server v2021.2.5 and below does not employ server-side validation. Rated high severity (CVSS 7.1), thi
CVE-2022-38164 MEDIUM
6.5 Nov 07

A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. Rated medium severity (CVSS 6.5), th
CVE-2022-38342 MEDIUM
6.5 Sep 13

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerab
CVE-2022-38339 MEDIUM
6.1 Sep 19

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allo

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2022-38340 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy