PT-2022-21152 · Rdiffweb · Rdiffweb

Ikus060 · Published 2022-09-15 · Updated 2022-09-18 · CVE-2022-3221

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.3

Description The issue is related to Cross-Site Request Forgery (CSRF) in the GitHub repository ikus060/rdiffweb. When adding SSH public keys to a profile, the server accepts GET requests, which can lead to unauthorized access to the system and backups.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 to resolve the issue. As a temporary workaround, consider restricting access to the SSH public key addition feature until the patch is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-3221

GHSA-VQ4H-XRWC-M639

PYSEC-2022-278

Affected Products

Rdiffweb

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3221.json · Exploit
• 🔥 https://huntr.dev/bounties/1fa1aac9-b16a-4a70-a7da-960b3908ae1d · Exploit
• https://github.com/ikus060/rdiffweb/commit/9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3221 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3221 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-278 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vq4h-xrwc-m639 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-278.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cvenotify/36204 · Telegram Post
• https://github.com/advisories/GHSA-vq4h-xrwc-m639 · Note
• https://t.me/cibsecurity/49807 · Telegram Post
• https://t.me/cvenotify/36405 · Telegram Post