PT-2022-21758 · Ikus060 · Rdiffweb

Published 2022-09-28 · Updated 2022-10-03 · CVE-2022-3326

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ikus060/rdiffweb versions prior to 2.4.9

Description The issue concerns weak password requirements. Specifically, it allows users to set passwords with all spaces, bypassing password complexity requirements due to a lack of password entropy validation. The password policy requires passwords to be between 8 and 128 characters, but this does not prevent the use of weak passwords. This issue has been fixed in version 2.4.9.

Recommendations For versions prior to 2.4.9, update to version 2.4.9 to resolve the issue. As a temporary workaround, consider enforcing a stronger password policy that includes validation of password entropy to minimize the risk of exploitation. Restrict access to password settings until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2022-3326

GHSA-8WXF-C45W-G66G

PYSEC-2022-297

Affected Products

Rdiffweb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3326.json · Exploit
• 🔥 https://huntr.dev/bounties/1f6a5e49-23f2-45f7-8661-19f9cee8ae97 · Exploit
• https://github.com/ikus060/rdiffweb/commit/ee98e5af78ec60db8a17fef6ea0ca250e3f31eec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3326 · Security Note
• https://osv.dev/vulnerability/GHSA-8wxf-c45w-g66g · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-297 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3326 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-297.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cibsecurity/50660 · Telegram Post