PT-2022-13226 · Unknown · @Peertube/Embed-Api

Published 2022-02-08 · Updated 2022-02-15 · CVE-2022-0508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions @peertube/embed-api versions prior to Not released yet @peertube/embed-api version 4.0.0 and prior

Description The issue is related to Server-Side Request Forgery (SSRF) in the @peertube/embed-api.

Recommendations For @peertube/embed-api versions prior to the fixed version, consider restricting access to the embed API until a patch is available. For @peertube/embed-api version 4.0.0 and prior, consider restricting access to the embed API until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-0508

GHSA-MV26-CX23-VRFG

Affected Products

@Peertube/Embed-Api

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0508.json · Exploit
• 🔥 https://huntr.dev/bounties/c3724574-b6c9-430b-849b-40dd2b20f23c · Exploit
• https://github.com/chocobozzz/peertube/commit/f33e515991a32885622b217bf2ed1d1b0d9d6832 · Patch
• https://osv.dev/vulnerability/GHSA-mv26-cx23-vrfg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0508 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0508 · Vendor Advisory
• https://github.com/chocobozzz/peertube · Note
• https://t.me/cibsecurity/36989 · Telegram Post
• https://t.me/cvenotify/26430 · Telegram Post