PT-2022-19733 · Unknown · Connect-Multiparty

Published 2022-05-16 · Updated 2025-05-20 · CVE-2022-29623

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Connect-Multiparty version 2.2.0

Description An arbitrary file upload vulnerability in the file upload module allows attackers to execute arbitrary code via a crafted PDF file.

Recommendations For Connect-Multiparty version 2.2.0, consider disabling the file upload module until a patch is available to prevent exploitation. Restrict access to the file upload functionality to minimize the risk of arbitrary code execution. Avoid using the file upload feature with untrusted or unknown PDF files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-29623

GHSA-W2XW-44R3-4V9G

Affected Products

Connect-Multiparty

References · 10

• 🔥 https://youtube.com/watch?v=i3xJR-91rrM · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29623 · Security Note
• https://osv.dev/vulnerability/GHSA-w2xw-44r3-4v9g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29623 · Vendor Advisory
• https://github.com/expressjs/connect-multiparty · Note
• https://github.com/expressjs/connect-multiparty/releases/tag/2.2.0 · Note
• https://t.me/cvenotify/123030 · Telegram Post
• https://t.me/cvenotify/30651 · Telegram Post
• https://npmjs.com/package/connect-multiparty · Note
• https://t.me/cibsecurity/42733 · Telegram Post