PT-2022-20717 · Docebo · Docebo Community Edition

Published 2022-06-22 · Updated 2024-08-03 · CVE-2022-31362

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docebo Community Edition versions 4.0.5 and below

Description The issue is related to an arbitrary file upload vulnerability. It is noted that this vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For Docebo Community Edition versions 4.0.5 and below, as a temporary workaround, consider restricting access to file upload functionality until a solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-31362

Affected Products

Docebo Community Edition

References · 6

• 🔥 https://swascan.com/security-advisory-docebo-community-edition · Exploit
• https://osv.dev/vulnerability/CVE-2022-31362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31362 · Security Note
• https://twitter.com/Masonhck3571/status/1710766410648174810 · Twitter Post
• https://blog.formalms.org/about/blog/20-life-after-docebo-the-forma-project-begins.html · Note
• https://t.me/cvenotify/88731 · Telegram Post