PT-2022-21435 · Rdiffweb · Rdiffweb

Published 2022-09-23 · Updated 2022-09-26 · CVE-2022-3269

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.7

Description The issue allows an attacker to gain unauthorized access to a user's account due to session fixation. This occurs because the application fails to invalidate session cookies on logout, causing the cookies to remain the same after closing the browser and even after a password reset. These cookies can be reassigned to additional user logins, leading to session fixation. An attacker can exploit this by obtaining a session cookie through another attack and using it to access the account of users who are using the same browser, as long as the session cookie persists.

Recommendations For versions prior to 2.4.7, update to version 2.4.7 to resolve the issue.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-3269

GHSA-J3Q4-GMJ4-MJ95

PYSEC-2022-290

Affected Products

Rdiffweb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3269.json · Exploit
• 🔥 https://huntr.dev/bounties/67c25969-5e7a-4424-817e-e1a918f63cc6 · Exploit
• https://github.com/ikus060/rdiffweb/commit/39e7dcd4a1f44d2a7bd92b79d78a800910b1b22b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3269 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3269 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-290 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3q4-gmj4-mj95 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-290.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cvenotify/36745 · Telegram Post
• https://t.me/cvenotify/36753 · Telegram Post