PT-2022-21437 · Rdiffweb · Rdiffweb

Published 2022-10-06 · Updated 2022-10-10 · CVE-2022-3273

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:P/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.5.0a4

Description The issue concerns the allocation of resources without limits or throttling, which can be exploited for brute force attacks to guess passwords. There is no rate limit to prevent attackers from attempting multiple incorrect password attempts. It is estimated that this could potentially affect a significant number of devices worldwide, although the exact number is not specified.

Recommendations For versions prior to 2.5.0a4, update to version 2.5.0a4 or later to implement a limit on the number of incorrect password attempts, preventing brute force attacks.

Exploit

Fix

Allocation of Resources Without Limits

Inadequate Encryption Strength

Weakness Enumeration

CWE-770

CWE-326

Related Identifiers

CVE-2022-3273

GHSA-9G3V-V24Q-JJ5P

PYSEC-2022-43156

Affected Products

Rdiffweb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3273.json · Exploit
• 🔥 https://huntr.dev/bounties/a6df4bad-3382-4add-8918-760d885690f6 · Exploit
• https://github.com/ikus060/rdiffweb/commit/b5e3bb0a98268d18ceead36ab9b2b7eaacd659a8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3273 · Security Note
• https://osv.dev/vulnerability/GHSA-9g3v-v24q-jj5p · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43156 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3273 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43156.yaml · Note
• https://github.com/ikus060/rdiffweb · Note