PT-2022-22208 · Rdiffweb · Rdiffweb

Published 2022-10-13 · Updated 2022-10-14 · CVE-2022-3457

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.5.0a5

Description The issue concerns a lack of origin validation in web traffic. This could potentially allow unauthorized access or actions. Users are advised to take action to mitigate this risk.

Recommendations For versions prior to 2.5.0a5, upgrade to version 2.5.0a5 to resolve the issue.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2022-3457

GHSA-824X-JCXF-HPFG

PYSEC-2022-43161

Affected Products

Rdiffweb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3457.json · Exploit
• https://github.com/ikus060/rdiffweb/commit/afc1bdfab5161c74012ff2590a6ec49cc0d8fde0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3457 · Security Note
• https://osv.dev/vulnerability/GHSA-824x-jcxf-hpfg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3457 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43161 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43161.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://huntr.dev/bounties/cfcab02e-d6ad-4dcf-b1b0-da90434bc55b · Note
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin · Note