PT-2022-20901 · Rdiffweb · Rdiffweb

CVE-2022-3175 · Published 2022-09-13 · Updated 2022-09-15

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.2

Description The issue concerns a missing custom error page in the GitHub repository ikus060/rdiffweb. This results in the leakage of error information. The problem is resolved in version 2.4.2.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 to resolve the issue.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-756

CWE-755

Related Identifiers

CVE-2022-3175

GHSA-CH4C-278Q-5654

PYSEC-2022-273

Affected Products

Rdiffweb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3175.json · Exploit
• 🔥 https://huntr.dev/bounties/c40badc3-c9e7-4b69-9e2e-2b9f05865159 · Exploit
• https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5 · Patch
• https://osv.dev/vulnerability/GHSA-ch4c-278q-5654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3175 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-273 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3175 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-273.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://github.com/ikus060/rdiffweb/blob/4d1232cd0586eb79d1a921969f8f7a198a00d92b/README.md?plain=1#L149 · Note
• https://github.com/advisories/GHSA-ch4c-278q-5654 · Note
• https://t.me/cvenotify/36267 · Telegram Post