PT-2022-24857 · Orchest · Orchest

Fruttasecca · Published 2022-09-30 · Updated 2022-10-04 · CVE-2022-39268

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Orchest versions prior to v2022.09.10

Description The issue allows an attacker to trick an innocent end user into submitting a web request that they did not intend, potentially causing actions such as client or server data leakage, change of session state, or manipulation of an end user's account. This is related to a Cross-site Request Forgery (CSRF) attack.

Recommendations Upgrade to v2022.09.10 to patch this vulnerability. As a temporary workaround, rebuild and redeploy the Orchest auth-server with the specified commit.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-39268

GHSA-Q44F-8JPW-QV4J

Affected Products

Orchest

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39268.json · Exploit
• https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d · Patch
• https://github.com/orchest/orchest/pull/1324 · Patch
• https://osv.dev/vulnerability/CVE-2022-39268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39268 · Security Note
• https://github.com/orchest/orchest/security/advisories/GHSA-q44f-8jpw-qv4j · Note
• https://github.com/orchest/orchest/releases/tag/v2022.09.10 · Note