CVE-2022-1518 - Vulnerability Details - OpenCVE

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Illumina	Iseq 100 Local Run Manager Miniseq Miseq Miseq Dx Nextseq 500 Nextseq 550 Nextseq 550dx

Configuration 1 [-]

AND

cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:illumina:iseq_100:-:::::::*
	cpe:2.3:h:illumina:miniseq:-:::::::*
	cpe:2.3:h:illumina:miseq:-:::::::*
	cpe:2.3:h:illumina:miseq_dx:-:::::::*
	cpe:2.3:h:illumina:nextseq_500:-:::::::*
	cpe:2.3:h:illumina:nextseq_550:-:::::::*
	cpe:2.3:h:illumina:nextseq_550dx:-:::::::*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02

History

Wed, 16 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-06-24T15:00:14.741Z

Updated: 2025-04-16T16:16:54.839Z

Reserved: 2022-04-28T00:00:00.000Z

Link: CVE-2022-1518

Vulnrichment

Updated: 2024-08-03T00:10:02.827Z

NVD

Status : Modified

Published: 2022-06-24T15:15:09.270

Modified: 2024-11-21T06:40:53.240

Link: CVE-2022-1518

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "NextSeq 550Dx", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiSeq Dx", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "NextSeq 500 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "NextSeq 550 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiSeq Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "iSeq 100 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiniSeq Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}], "datePublic": "2022-06-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-24T15:00:14.000Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}], "source": {"discovery": "UNKNOWN"}, "title": "3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22", "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220602T06:00:00.000000Z", "ID": "CVE-2022-1518", "STATE": "PUBLIC", "TITLE": "3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NextSeq 550Dx", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiSeq Dx", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "NextSeq 500 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "NextSeq 550 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiSeq Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "iSeq 100 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiniSeq Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}]}}, "credit": [], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}]}, "solution": [], "source": {"advisory": "", "defect": [], "discovery": "UNKNOWN"}, "work_around": []}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:02.827Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T15:54:25.332039Z", "id": "CVE-2022-1518", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T16:16:54.839Z"}}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1518", "datePublished": "2022-06-24T15:00:14.741Z", "dateReserved": "2022-04-28T00:00:00.000Z", "dateUpdated": "2025-04-16T16:16:54.839Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:02.827Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-1518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T15:54:25.332039Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:54:27.408Z"}}], "cna": {"title": "3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22", "source": {"discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Illumina", "product": "NextSeq 550Dx", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "MiSeq Dx", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "NextSeq 500 Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "NextSeq 550 Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "MiSeq Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "iSeq 100 Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "MiniSeq Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}], "datePublic": "2022-06-02T00:00:00.000Z", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-06-24T15:00:14.000Z"}, "x_legacyV4Record": {"credit": [], "impact": {"cvss": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, "source": {"defect": [], "advisory": "", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "NextSeq 550Dx"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "MiSeq Dx"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "NextSeq 500 Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "NextSeq 550 Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "MiSeq Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "iSeq 100 Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "MiniSeq Instrument"}]}, "vendor_name": "Illumina"}]}}, "solution": [], "data_type": "CVE", "references": {"reference_data": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "work_around": [], "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-1518", "AKA": "", "STATE": "PUBLIC", "TITLE": "3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220602T06:00:00.000000Z"}}}}, "cveMetadata": {"cveId": "CVE-2022-1518", "state": "PUBLISHED", "dateUpdated": "2025-04-16T16:16:54.839Z", "dateReserved": "2022-04-28T00:00:00.000Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2022-06-24T15:00:14.741Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B", "versionEndIncluding": "3.1", "versionStartIncluding": "1.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*", "matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*", "matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*", "matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*", "matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."}, {"lang": "es", "value": "LRM contiene una vulnerabilidad de salto de directorio que puede permitir a un actor malicioso subir archivos fuera de la estructura de directorios prevista"}], "id": "CVE-2022-1518", "lastModified": "2024-11-21T06:40:53.240", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-24T15:15:09.270", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}