PT-2022-17030 · Unknown · Jqueryform

Paul Bisso · Published 2022-02-16 · Updated 2022-02-25 · CVE-2022-24983

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JQueryForm.com versions prior to 2022-02-05

Description The issue allows remote attackers to obtain the URI to any uploaded file by capturing the POST response. This can be chained with another issue to potentially lead to unauthenticated remote code execution on the underlying web server. The problem occurs because the Unique ID field is contained in the POST response upon submitting a form.

Recommendations For versions prior to 2022-02-05, consider restricting access to the form submission endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the Unique ID field in the POST response until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-24983

Affected Products

Jqueryform

References · 7

• https://jqueryform.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24983 · Security Note
• https://t.me/cvenotify/27377 · Telegram Post
• https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560 · Note
• https://t.me/cibsecurity/37635 · Telegram Post
• https://nou-systems.com/cyber-security · Note