Medium severity5.5NVD Advisory· Published Nov 19, 2022· Updated Jun 17, 2026
CVE-2022-4065
CVE-2022-4065
Description
A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.testng:testngMaven | >= 6.13, < 7.5.1 | 7.5.1 |
org.testng:testngMaven | >= 7.6.0, < 7.7.0 | 7.7.0 |
Affected products
42- cpe:2.3:a:testng_project:testng:-:*:*:*:*:*:*:*
- ghsa-coords40 versionspkg:maven/org.testng/testngpkg:rpm/opensuse/mockito&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/mockito&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/snakeyaml&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/snakeyaml&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/testng&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/testng&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/testng&distro=openSUSE%20Leap%2015.6pkg:rpm/suse/mockito&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6pkg:rpm/suse/snakeyaml&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/snakeyaml&distro=SUSE%20Manager%20Server%20Module%204.3pkg:rpm/suse/testng&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/testng&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/testng&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4
>= 6.13, < 7.5.1+ 39 more
- (no CPE)range: >= 6.13, < 7.5.1
- (no CPE)range: < 5.11.0-150200.3.7.1
- (no CPE)range: < 5.11.0-150200.3.7.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 5.11.0-150200.3.7.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 2.2-150200.3.15.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.4.0-150200.3.7.1
- (no CPE)range: < 7.10.1-150200.3.10.1
- cbeust/testngv5Range: 7.5.0
Patches
Vulnerability mechanics
References
11- github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422bnvdPatchThird Party AdvisoryWEB
- github.com/cbeust/testng/pull/2806nvdExploitPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-rc2q-x9mf-w3vfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-4065ghsaADVISORY
- vuldb.comnvdThird Party AdvisoryWEB
- github.com/cbeust/testng/pull/1596ghsaWEB
- github.com/cbeust/testng/releases/tag/7.7.0ghsaWEB
- github.com/cbeust/testng/releases/tag/7.7.1nvdWEB
- github.com/testng-team/testng/pull/2899ghsaWEB
- github.com/testng-team/testng/releases/tag/7.5.1ghsaWEB
- vuldb.comnvdWEB
News mentions
0No linked articles in our index yet.