PT-2022-13197 · Jsdecena · Laracom

Published 2022-02-04 · Updated 2022-02-10 · CVE-2022-0472

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsdecena/laracom versions prior to 2.0.9

Description The issue concerns an unrestricted upload of files with dangerous types. This could potentially allow attackers to upload malicious files, posing a security risk.

Recommendations For versions prior to 2.0.9, update to version 2.0.9 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types until the update can be applied.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2022-0472

GHSA-5Q5W-MQP6-G2GH

Affected Products

Laracom

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0472.json · Exploit
• 🔥 https://huntr.dev/bounties/cb5b8563-15cf-408c-9f79-4871ea0a8713 · Exploit
• https://github.com/jsdecena/laracom/commit/256026193ce994dc4c1365e02f414d8a0cd77ae8 · Patch
• https://osv.dev/vulnerability/CVE-2022-0472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0472 · Security Note
• https://osv.dev/vulnerability/GHSA-5q5w-mqp6-g2gh · Vendor Advisory
• https://github.com/jsdecena/laracom · Note
• https://t.me/cibsecurity/36908 · Telegram Post