Detections
Analytics

SCA: security update for org.apache.ivy:ivy (GHSA-wv7w-rj2x-556x)

high Tenable Cloud Security Plugin ID 420120

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a
 user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation,
 module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy
 coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or
 repository or can overwrite different artifacts inside of the local cache. In order to exploit this
 vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests
 containing ".." sequences and a "normal" repository will not interpret them as part of the artifact
 coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1. (CVE-2022-37866)

See Also

https://github.com/advisories/GHSA-wv7w-rj2x-556x

Plugin Details

Severity: High

ID: 420120

Version: Revision 1.15

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2022-37866

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/7/2022

Vulnerability Publication Date: 11/7/2022

Reference Information

CVE: CVE-2022-37866

cwe: CWE-22