PT-2022-23031 · Bookwyrm · Bookwyrm

Mouse-Reeve · Published 2022-08-02 · Updated 2023-07-21 · CVE-2022-35925

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions BookWyrm versions prior to 0.4.5

Description BookWyrm, a social network for tracking reading, has an issue where versions prior to 0.4.5 lack rate limiting on authentication views. This lack of rate limiting allows for brute-force attacks. The issue has been patched in version 0.4.5.

Recommendations For versions prior to 0.4.5, update to version 0.4.5 to patch the issue. As a temporary workaround for users unable to upgrade, manually update the nginx.conf file with the necessary changes to add rate limiting on authentication views. Admins with existing instances should update their nginx.conf file that was created when the instance was set up.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Improper Authentication

Weakness Enumeration

CWE-307

CWE-287

Related Identifiers

CVE-2022-35925

GHSA-JVP3-MQV8-5RJW

Affected Products

Bookwyrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35925.json · Exploit
• 🔥 https://huntr.dev/bounties/ebee593d-3fd0-4985-bf5e-7e7927e08bf6 · Exploit
• https://osv.dev/vulnerability/CVE-2022-35925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35925 · Security Note
• https://github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f · Patch
• https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-jvp3-mqv8-5rjw · Note
• https://t.me/cibsecurity/47441 · Telegram Post