CVE catalog

CVE-2022-23457

ESAPI vulnerabilities

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.85% · Oct 25, 2026

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibowasp-esapi-javasid2.4.0.0-3fixed
Debianlibowasp-esapi-javatrixie2.4.0.0-2.1fixed
Debianlibowasp-esapi-javabookworm2.4.0.0-2fixed
Ubuntulibowasp-esapi-javanoble2.4.0.0-2ubuntu0.1fixed
Ubuntulibowasp-esapi-javapro2.1.0-3.1vulnerable
Ubuntulibowasp-esapi-javapro2.2.3.1-1vulnerable
Ubuntulibowasp-esapi-javapro2.2.3.1-1ubuntu0.1~esm1fixed
Ubuntulibowasp-esapi-java24.042.4.0.0-2vulnerable
Ubuntulibowasp-esapi-java24.042.4.0.0-2ubuntu0.1fixed
Ubuntulibowasp-esapi-javapro2.1.0-3.1vulnerable
Ubuntulibowasp-esapi-javapro2.2.3.1-1vulnerable
Ubuntulibowasp-esapi-javapro2.2.3.1-1ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibowasp-esapi-javasourcesid2.4.0.0-1not yet assignedNot reported[1010339]
Debianlibowasp-esapi-javasourcetrixie2.4.0.0-1not yet assignedNot reported[1010339]
Debianlibowasp-esapi-javasourcebookworm2.4.0.0-1not yet assignedNot reported[1010339]
Ubuntulibowasp-esapi-javadebnoble2.4.0.0-2ubuntu0.1Not reportedNot reportedNot reported
Ubuntulibowasp-esapi-javadebpro2.2.3.1-1ubuntu0.1~esm1Not reportedUSN-8181-1Not reported
Ubuntulibowasp-esapi-javadeb24.042.4.0.0-2ubuntu0.1Not reportedUSN-8181-1Not reported
Ubuntulibowasp-esapi-javadebpro2.2.3.1-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2022-23457Not reported

[Debian bug #1010339]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libowasp-esapi-java]Fixed
    Details (2)

    • 2.4.0.0-2 · all · bookworm

      Fixed · Fixed: 2.4.0.0-1

      usn · libowasp-esapi-java · debian · bookworm

    • 2.4.0.0-2 · all · bookworm

      Fixed · Fixed: 2.4.0.0-1

      usn · libowasp-esapi-java · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]