PT-2022-21436 · Rdiffweb · Rdiffweb

Published 2022-09-26 · Updated 2022-09-28 · CVE-2022-3272

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.8

Description The issue arises from improper handling of length parameter inconsistency, specifically in the validation of email length. This allows users to insert an email longer than 255 characters. If a user signs up with an excessively long email and performs actions like logging in, withdrawing, or changing their email, it can cause a denial of service due to server overload. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 2.4.8, update to version 2.4.8, which sets length limits for username, email, and root directory to prevent the issue. As a temporary workaround, consider restricting the length of user input for emails to prevent potential denial of service attacks until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2022-3272

GHSA-QRJ3-HRGJ-FM7R

PYSEC-2022-291

Affected Products

Rdiffweb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3272.json · Exploit
• 🔥 https://huntr.dev/bounties/733678b9-daa1-4d6a-875a-382fa09a6e38 · Exploit
• 🔥 https://huntr.com/bounties/733678b9-daa1-4d6a-875a-382fa09a6e38 · Exploit
• https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-291 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3272 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrj3-hrgj-fm7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3272 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-291.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cibsecurity/50523 · Telegram Post