PT-2022-24449 · Valine · Valine

Published 2022-09-19 · Updated 2022-09-22 · CVE-2022-38545

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Valine version 1.4.18

Description The issue allows attackers to execute arbitrary code via a crafted POST request, enabling remote code execution (RCE). This can be achieved by sending a specifically designed request to the affected system.

Recommendations For Valine version 1.4.18, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

CVE-2022-38545

GHSA-MCVG-G9WX-V5VX

Affected Products

Valine

References · 9

• 🔥 https://github.com/xCss/Valine/issues/400 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38545 · Security Note
• https://osv.dev/vulnerability/GHSA-mcvg-g9wx-v5vx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38545 · Vendor Advisory
• https://github.com/xCss/Valine/commit/c40826c5816c98d797a6b1ed8b62bddf73ed4f65 · Note
• https://github.com/xCss/Valine · Note
• https://github.com/xCss/Valine/releases/tag/v1.5.0 · Note
• https://t.me/cvenotify/36485 · Telegram Post
• https://t.me/cibsecurity/50107 · Telegram Post