{"id":"CVE-2022-0072","state":"PUBLISHED","title":"Directory Traversal in OpenLiteSpeed Web Server","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","publishedAt":"2022-10-27T19:28:49.031Z","updatedAt":"2025-05-09T19:18:17.065Z","severity":{"score":5.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","source":"palo_alto"},"assigner":"palo_alto","products":["LiteSpeed Technologies OpenLiteSpeed Web Server","LiteSpeed Technologies LiteSpeed Web Server"],"affected":[{"vendor":"LiteSpeed Technologies","product":"OpenLiteSpeed Web Server","defaultStatus":"unaffected","versions":[{"version":"1.5.11","status":"affected","lessThanOrEqual":"1.5.12","versionType":"custom"},{"version":"1.6.5","status":"affected","lessThanOrEqual":"1.6.20.1","versionType":"custom"},{"version":"1.7.0","status":"affected","lessThan":"1.7.16.1","versionType":"custom"}],"repo":"https://github.com/litespeedtech/openlitespeed"},{"vendor":"LiteSpeed Technologies","product":"LiteSpeed Web Server","defaultStatus":"unaffected","versions":[{"version":"1.5.11","status":"affected","lessThanOrEqual":"1.5.12","versionType":"custom"},{"version":"1.6.5","status":"affected","lessThanOrEqual":"1.6.20.1","versionType":"custom"},{"version":"1.7.0","status":"affected","lessThan":"1.7.16.1","versionType":"custom"}]}],"references":["https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061","https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T19:49:26.075Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/0xxx/CVE-2022-0072.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-0072","state":"PUBLISHED","datePublished":"2022-10-27T19:28:49.031Z","dateUpdated":"2025-05-09T19:18:17.065Z","assignerShortName":"palo_alto","assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","requesterUserId":"4bdfcd35-6352-4419-9b3e-118da80d0642","dateReserved":"2021-12-28T23:57:03.295Z"},"containers":{"cna":{"title":"Directory Traversal in OpenLiteSpeed Web Server","descriptions":[{"lang":"en","value":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1"}],"affected":[{"vendor":"LiteSpeed Technologies","product":"OpenLiteSpeed Web Server","defaultStatus":"unaffected","versions":[{"version":"1.5.11","status":"affected","lessThanOrEqual":"1.5.12","versionType":"custom"},{"version":"1.6.5","status":"affected","lessThanOrEqual":"1.6.20.1","versionType":"custom"},{"version":"1.7.0","status":"affected","lessThan":"1.7.16.1","versionType":"custom"}],"repo":"https://github.com/litespeedtech/openlitespeed"},{"vendor":"LiteSpeed Technologies","product":"LiteSpeed Web Server","defaultStatus":"unaffected","versions":[{"version":"1.5.11","status":"affected","lessThanOrEqual":"1.5.12","versionType":"custom"},{"version":"1.6.5","status":"affected","lessThanOrEqual":"1.6.20.1","versionType":"custom"},{"version":"1.7.0","status":"affected","lessThan":"1.7.16.1","versionType":"custom"}]}],"references":[{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061"},{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"palo_alto","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateUpdated":"2022-11-04T20:49:55.443Z"},"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061","tags":["x_transferred"]},{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T23:18:41.599Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-09T19:18:00.655604Z","id":"CVE-2022-0072","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-09T19:18:17.065Z"}}]}}}