PT-2023-15902 · Sisimai · Sisimai

Gmcabrita · Publicado 2023-01-17 · Atualizado 2024-05-17 · CVE-2022-4891

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Sisimai versions up to 4.25.14p11

Description A vulnerability has been found in the function to plain of the file lib/sisimai/string.rb, leading to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used.

Recommendations For Sisimai versions up to 4.25.14p11, upgrade to version 4.25.14p12 to address this issue. As a temporary workaround, consider restricting the use of the to plain function in the lib/sisimai/string.rb file until the patch is applied.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CVE-2022-4891

GHSA-VM74-J4WQ-82XJ

Produtos afetados

Sisimai

Referências · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sisimai/CVE-2022-4891.yml · Exploit
• 🔥 https://github.com/sisimai/rb-sisimai/pull/244 · Exploit
• 🔥 https://gist.githubusercontent.com/gmcabrita/e5dc0332473fc2e3a7a407434c8d21c7/raw/00b12035e5e1b685469f143b94301a50306376ba/example.html · Exploit
• https://github.com/sisimai/rb-sisimai/commit/51fe2e6521c9c02b421b383943dc9e4bbbe65d4e · Correção
• https://github.com/sisimai/rb-sisimai/releases/tag/v4.25.14p12 · Correção
• https://github.com/sisimai/rb-sisimai · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-4891 · Nota de Segurança
• https://vuldb.com/?id.218452 · Nota
• https://osv.dev/vulnerability/CVE-2022-4891 · Aviso do Fabricante
• https://vuldb.com/?ctiid.218452 · Nota
• https://osv.dev/vulnerability/GHSA-vm74-j4wq-82xj · Aviso do Fabricante
• https://t.me/cibsecurity/56609 · Publicação no Telegram