PT-2022-20564 · Unknown · Activitywatch

Zozs · Published 2022-09-07 · Updated 2022-09-13 · CVE-2022-31149

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ActivityWatch versions prior to 0.12.0b2

Description The issue allows attackers to perform DNS rebinding attacks, giving them full access to the ActivityWatch REST API. This impacts all users running the affected versions of ActivityWatch.

Recommendations For versions prior to 0.12.0b2, upgrade to v0.12.0b2 or later to receive a patch. As a temporary workaround, consider blocking DNS lookups that resolve to 127.0.0.1.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2022-31149

GHSA-V9FG-6G9J-H4X4

Affected Products

Activitywatch

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31149.json · Exploit
• 🔥 https://gist.github.com/zozs/fdebbce75fc8538c15851b46db944a16 · Exploit
• https://osv.dev/vulnerability/CVE-2022-31149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31149 · Security Note
• https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-v9fg-6g9j-h4x4 · Note
• https://github.com/ActivityWatch/activitywatch/discussions/778 · Note