PT-2022-20900 · Rdiffweb · Rdiffweb

Published 2022-09-13 · Updated 2022-09-15 · CVE-2022-3174

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.2

Description The issue allows a user's cookies to be sent to the server with an unencrypted request over the HTTP protocol because the 'Secure' attribute is missing in the HTTPS session. This affects the confidentiality of the cookies.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data that may be exposed through unencrypted cookie transmission until the update is applied.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-614

Related Identifiers

CVE-2022-3174

GHSA-MJW4-XVX6-3GRG

PYSEC-2022-271

Affected Products

Rdiffweb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3174.json · Exploit
• 🔥 https://huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce · Exploit
• https://github.com/ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3174 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-271 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3174 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mjw4-xvx6-3grg · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-271.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://github.com/advisories/GHSA-mjw4-xvx6-3grg · Note