PT-2022-20934 · Rdiffweb · Rdiffweb

Published 2022-09-13 · Updated 2022-09-15 · CVE-2022-3179

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.2

Description The issue is related to weak password requirements. Specifically, versions prior to 2.4.2 have no password policy or password checking, making users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 to enforce minimum and maximum password lengths and mitigate the risk of brute force password guessing attacks.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2022-3179

GHSA-MP5P-G2JV-R8QW

PYSEC-2022-272

Affected Products

Rdiffweb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3179.json · Exploit
• 🔥 https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5fe · Exploit
• https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3179 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-272 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mp5p-g2jv-r8qw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3179 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-272.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://github.com/advisories/GHSA-mp5p-g2jv-r8qw · Note
• https://t.me/cibsecurity/49667 · Telegram Post