PT-2022-19567 · Apache Friends · Xampp

Published 2022-05-23 · Updated 2022-06-07 · CVE-2022-29376

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xampp for Windows versions 8.1.4 and below

Description The issue is related to insecure permissions for the install directory, allowing attackers to execute arbitrary code by overwriting binaries in the directory.

Recommendations For versions 8.1.4 and below, consider changing the permissions of the install directory to prevent unauthorized access until a patch is available. As a temporary workaround, restrict write access to the install directory to minimize the risk of exploitation. Avoid using the vulnerable directory for executing binaries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-29376

Affected Products

Xampp

References · 6

• 🔥 https://github.com/ycdxsb/Vuln/blob/main/CVE-2022-29376/CVE-2022-29376.md · Exploit
• 🔥 https://github.com/ycdxsb/Vuln/blob/main/Xampp-Install-Dir-Incorrect-Default-Permission/Xampp-Install-Dir-Incorrect-Default-Permission.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29376 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29376 · Vendor Advisory
• https://t.me/cibsecurity/43199 · Telegram Post
• https://t.me/cvenotify/30602 · Telegram Post