CVE-2022-38731 - CVE House
Back to Database
Status published Unknown CVE-2022-38731

Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal...

Vulnerability Description

Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-38731

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

dose
Vulnerable Versions:
18.08

Timeline

Official Publish: February 16th, 2023
Last Modified: March 19th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.