{"metadata": {"vulnerability": "CVE-2022-36007", "count": 22, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 14}}, "data": [{"timestamp": "2022-07-15T00:00:00Z", "date_only": false, "value": "2022-07-15T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-36007", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-08-14T00:25:10Z", "date_only": false, "value": "2022-08-14T00:25:10.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-36007", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-08-14T00:25:10Z", "date_only": false, "value": "2022-08-14T00:25:10.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2022-36007", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-08-15T00:00:00Z", "date_only": true, "value": "2022-08-15", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2022-36007", "record": "GSD-2022-36007", "field": "namespaces.gitlab.com.advisories.0.pubdate"}, {"timestamp": "2022-08-15T11:21:00Z", "date_only": false, "value": "2022-08-15T11:21:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4MMH-5VW7-RGVJ", "record": "GHSA-4MMH-5VW7-RGVJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-08-15T11:21:00Z", "date_only": false, "value": "2022-08-15T11:21Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-36007", "record": "GSD-2022-36007", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-08-15T11:21:40.967Z", "date_only": false, "value": "2022-08-15T11:21:40.967", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-36007", "record": "FKIE_CVE-2022-36007", "field": "published"}, {"timestamp": "2022-08-15T14:37:55Z", "date_only": false, "value": "2022-08-15T14:37:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/48139", "record": "CVE-2022-36007", "field": "creation_timestamp", "uuid": "d87d96d9-aed6-4cc6-a444-951c0865e578", "content": "\u203c CVE-2022-36007 \u203c\n\nVenice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions `load-file` and `load-resource`. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the load paths: `[ \"/Users/foo/resources\" ]` When passing **relative** paths to these two vulnerable functions everything is fine: `(load-resource \"test.png\")` => loads the file \"/Users/foo/resources/test.png\" `(load-resource \"../resources-alt/test.png\")` => rejected, outside the load path When passing **absolute** paths to these two vulnerable functions Venice may return files outside the configured load paths: `(load-resource \"/Users/foo/resources/test.png\")` => loads the file \"/Users/foo/resources/test.png\" `(load-resource \"/Users/foo/resources-alt/test.png\")` => loads the file \"/Users/foo/resources-alt/test.png\" !!! The latter call suffers from the _Partial Path Traversal_ vulnerability. This issue\u00e2\u20ac\u2122s scope is limited to absolute paths whose name prefix matches a load path. E.g. for a load-path `\"/Users/foo/resources\"`, the actor can cause loading a resource also from `\"/Users/foo/resources-alt\"`, but not from `\"/Users/foo/images\"`. Versions of Venice before and including v1.10.17 are affected by this issue. Upgrade to Venice >= 1.10.18, if you are on a version < 1.10.18. There are currently no known workarounds.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/48139"}, {"timestamp": "2022-08-16T00:00:00Z", "date_only": true, "value": "2022-08-16", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2022-36007", "record": "GSD-2022-36007", "field": "namespaces.gitlab.com.advisories.0.date"}, {"timestamp": "2022-08-16T17:02:00Z", "date_only": false, "value": "2022-08-16T17:02Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-36007", "record": "GSD-2022-36007", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-08-18T19:07:58Z", "date_only": false, "value": "2022-08-18T19:07:58Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4MMH-5VW7-RGVJ", "record": "GHSA-4MMH-5VW7-RGVJ", "field": "published"}, {"timestamp": "2022-08-18T19:07:58Z", "date_only": false, "value": "2022-08-18T19:07:58Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4MMH-5VW7-RGVJ", "record": "GHSA-4MMH-5VW7-RGVJ", "field": "modified"}, {"timestamp": "2023-12-13T01:19:21.792Z", "date_only": false, "value": "2023-12-13T01:19:21.792701Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-36007", "record": "GSD-2022-36007", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T09:51:59.845Z", "date_only": false, "value": "2024-08-03T09:51:59.845Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-36007", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-22T15:45:03.645Z", "date_only": false, "value": "2025-04-22T15:45:03.645030Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-36007", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-04-22T15:45:03.645Z", "date_only": false, "value": "2025-04-22T15:45:03.645030Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-36007", "record": "FKIE_CVE-2022-36007", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-04-22T17:41:52.757Z", "date_only": false, "value": "2025-04-22T17:41:52.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-36007", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-04-22T17:41:52.757Z", "date_only": false, "value": "2025-04-22T17:41:52.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-36007", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-08-22T21:02:31.672Z", "date_only": false, "value": "2025-08-22T21:02:31.672825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwze4vmdvk26", "record": "CVE-2022-36007", "field": "creation_timestamp", "uuid": "8fc64b5d-feed-4a87-beed-c503f73eeaa3", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwze4vmdvk26"}, {"timestamp": "2026-06-17T04:52:43.633Z", "date_only": false, "value": "2026-06-17T04:52:43.633", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-36007", "record": "FKIE_CVE-2022-36007", "field": "lastModified"}, {"timestamp": "2026-09-04T18:00:04Z", "date_only": false, "value": "2026-09-04T18:00:04.000683Z", "kind": "sighting", "label": "Seen", "source": "Telegram/DGzHuk8RVb1b8Xt8T_i7JrWo03tk4z5tw950ouDC7Dv-DN4", "record": "CVE-2022-36007", "field": "creation_timestamp", "uuid": "8a6b3103-9ad9-4493-bfa5-e17d8836a10f"}, {"timestamp": "2026-09-05T01:00:20.559Z", "date_only": false, "value": "2026-09-05T01:00:20.559993Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/DGzHuk8RVb1b8Xt8T_i7JrWo03tk4z5tw950ouDC7Dv-DN4", "record": "CVE-2022-36007", "field": "creation_timestamp", "uuid": "8a08e226-d6b4-44ba-aaa0-152ac1cf00a3"}]}