PT-2022-14166 · Erudika · Erudika/Para

Published 2022-05-24 · Updated 2022-06-03 · CVE-2022-1848

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions erudika/para versions prior to 1.45.11 Paraara versions prior to 1.46.0

Description The issue concerns business logic errors in the GitHub repository erudika/para and Paraara. A user can create more than one app, even after they reach the app limit.

Recommendations For erudika/para versions prior to 1.45.11, update to version 1.45.11 or later to resolve the issue. For Paraara versions prior to 1.46.0, update to version 1.46.0 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-840

Related Identifiers

CVE-2022-1848

GHSA-4793-8WWH-JXXR

Affected Products

Erudika/Para

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1848.json · Exploit
• 🔥 https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a · Exploit
• https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1848 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1848 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4793-8wwh-jxxr · Vendor Advisory
• https://github.com/erudika/para · Note
• https://t.me/cibsecurity/43243 · Telegram Post