PT-2022-23171 · Unknown · Mangadex-Downloader

Mansuf · Published 2022-09-07 · Updated 2022-09-16 · CVE-2022-36082

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions mangadex-downloader versions 1.3.0 through 1.7.2

Description The issue occurs when using the file:<location> command with a web URL location, causing the mangadex-downloader to attempt to open and read a file on the local disk for each line of website content. This could potentially allow unauthorized access to local files. The app only reads the files without executing them, but it is still a significant concern.

Recommendations For mangadex-downloader versions 1.3.0 through 1.7.1, update to version 1.7.2 or later to resolve the issue. For version 1.7.2, no further action is required as it contains a patch for this issue. As a temporary workaround for versions prior to 1.7.2, consider double-checking the URL before proceeding to download.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-36082

GHSA-R9X7-2XMR-V8FW

PYSEC-2022-264

Affected Products

Mangadex-Downloader

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36082.json · Exploit
• https://github.com/mansuf/mangadex-downloader/commit/439cc2825198ebc12b3310c95c39a8c7710c9b42 · Patch
• https://osv.dev/vulnerability/GHSA-r9x7-2xmr-v8fw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36082 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36082 · Security Note
• https://github.com/mansuf/mangadex-downloader/security/advisories/GHSA-r9x7-2xmr-v8fw · Note
• https://github.com/mansuf/mangadex-downloader · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mangadex-downloader/PYSEC-2022-264.yaml · Note
• https://t.me/cibsecurity/49416 · Telegram Post