CVE-2022-23457 — Path Traversal in ESAPI

Affected: OWASP ESAPI org.owasp.esapi:esapi

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.

USN-8181-1 — libowasp-esapi-java vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: libowasp-esapi-java, Ubuntu:Pro:18.04:LTS: libowasp-esapi-java, Ubuntu:Pro:20.04:LTS: libowasp-esapi-java, Ubuntu:Pro:22.04:LTS: libowasp-esapi-java, Ubuntu:24.04:LTS: libowasp-esapi-java

Jaroslav Lobačevski discovered that ESAPI incorrectly validated directory paths during path verification. An attacker could possibly use this issue to bypass directory validation checks, leading to control-flow bypass. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-23457)

Kevin W. Wall and Sebastian Passaro discovered that ESAPI did not properly sanitize javascript URLs because of an incorrect regular expression. An attacker could possibly use this issue to perform a cross-site scripting attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-24891)

Longlong Gong discovered that ESAPI did not properly neutralize special elements during SQL injection defense. A remote attacker could possibly use this issue to perform SQL injection. (CVE-2025-5878)

Most recent entries from all

CVE-2022-23457 — Path Traversal in ESAPI

USN-8181-1 — libowasp-esapi-java vulnerabilities