PT-2022-21868 · Rdiffweb · Rdiffweb

Published 2022-10-06 · Updated 2022-10-12 · CVE-2022-3376

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.5.0a4

Description The issue concerns weak password requirements. Specifically, it allows users to set their new password to be the same as the old password during a password reset. This is resolved in version 2.5.0a4, which enforces a password policy preventing the new password from being the same as the old one.

Recommendations For versions prior to 2.5.0a4, update to version 2.5.0a4 or later to enforce a stronger password policy that prevents users from setting their new password to be the same as the old one.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2022-3376

GHSA-7WR6-FJ4X-893V

PYSEC-2022-43157

Affected Products

Rdiffweb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3376.json · Exploit
• 🔥 https://huntr.dev/bounties/a9021e93-6d18-4ac1-98ce-550c4697a4ed · Exploit
• https://github.com/ikus060/rdiffweb/commit/2ffc2af65c8f8113b06e0b89929c604bcdf844b9 · Patch
• https://osv.dev/vulnerability/CVE-2022-3376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7wr6-fj4x-893v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3376 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-43157 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43157.yaml · Note
• https://github.com/ikus060/rdiffweb · Note