PT-2022-21580 · Rdiffweb · Rdiffweb

Published 2022-09-28 · Updated 2022-09-30 · CVE-2022-3292

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.4.9

Description The issue concerns the use of cache containing sensitive information. Due to improper cache control, an attacker can view sensitive information even if they are not logged into an account.

Recommendations For versions prior to 2.4.9, update to version 2.4.9 or later, which contains a patch for this issue.

Exploit

Fix

Weakness Enumeration

CWE-524

Related Identifiers

CVE-2022-3292

GHSA-7FQM-JM52-F9VC

PYSEC-2022-296

Affected Products

Rdiffweb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3292.json · Exploit
• 🔥 https://huntr.dev/bounties/e9309018-e94f-4e15-b7d1-5d38b6021c5d · Exploit
• https://github.com/ikus060/rdiffweb/commit/2406780831618405a13113377a784f3102465f40 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3292 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3292 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-296 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7fqm-jm52-f9vc · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-296.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cibsecurity/50624 · Telegram Post