CVE-2022-3221 – rdiffweb

Package

Manager: pip
Name: rdiffweb
Vulnerable Version: >=0 <2.4.3

Severity

Level: High

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.0017 pctl0.38718

Details

rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.

Metadata

Created: 2022-09-16T00:00:39Z
Modified: 2024-10-25T21:33:32Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-vq4h-xrwc-m639/GHSA-vq4h-xrwc-m639.json
CWE IDs: ["CWE-352"]
Alternative ID: GHSA-vq4h-xrwc-m639
Finding: F007
Auto approve: 1