PT-2022-22246 · Mealie · Mealie

Bruno Hernández · Published 2022-08-19 · Updated 2022-08-23 · CVE-2022-34615

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mealie version 1.0.0beta3

Description The issue is related to weak password requirements, which can be exploited by attackers to gain unauthorized access to the application through brute-force attacks.

Recommendations For Mealie version 1.0.0beta3, consider implementing stronger password requirements to mitigate the risk of brute-force attacks. As a temporary workaround, restrict access to sensitive areas of the application until a more robust password policy can be enforced. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2022-34615

Affected Products

Mealie

References · 7

• https://osv.dev/vulnerability/CVE-2022-34615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34615 · Security Note
• https://cwe.mitre.org/data/definitions/521.html · Note
• https://hub.docker.com/r/hkotel/mealie · Note
• https://docs.mealie.io/changelog/v0.5.6 · Note
• https://t.me/cibsecurity/48443 · Telegram Post
• https://gainsec.com/2022/08/19/cve-2022-34615-cve-2022-34621-cve-2022-34623-cve-2022-34624 · Note