PT-2022-20882 · Rdiffweb · Rdiffweb

Published 2022-09-08 · Updated 2022-09-14 · CVE-2022-3167

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.1

Description The issue is related to improper restriction of rendered UI layers or frames, allowing attackers to perform clickjacking attacks. This can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion.

Recommendations For versions prior to 2.4.1, update to version 2.4.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive features that can be exploited through clickjacking attacks until the update is applied.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2022-3167

GHSA-M379-X4XC-38X9

PYSEC-2022-268

Affected Products

Rdiffweb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3167.json · Exploit
• 🔥 https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c · Exploit
• https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-268 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3167 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m379-x4xc-38x9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3167 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-268.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cvenotify/35895 · Telegram Post
• https://github.com/advisories/GHSA-m379-x4xc-38x9 · Note