CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable to a path traversal flaw in the _is_safe_path method, allowing attackers to exploit unsanitized input in the plugin_id parameter to access unauthorized directories. This could lead to unauthorized file access and potential data exposure. Organizations using affected OpenSSL versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
Related CVEs
Other vulnerabilities affecting the same vendor(s)