PT-2022-27875 · Rdiffweb · Rdiffweb

Published 2022-12-22 · Updated 2022-12-29 · CVE-2022-4644

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions rdiffweb versions prior to 2.5.4

Description The issue is an Open Redirect in the GitHub repository ikus060/rdiffweb. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-4644

GHSA-639F-HXCV-84MC

PYSEC-2022-43003

Affected Products

Rdiffweb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4644.json · Exploit
• 🔥 https://huntr.dev/bounties/77e5f425-c764-4cb0-936a-7a76bfcf19b0 · Exploit
• https://github.com/ikus060/rdiffweb/commit/5f861670ef8f38ca8eea52a98672d0e0fabb5368 · Patch
• https://osv.dev/vulnerability/CVE-2022-4644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4644 · Security Note
• https://osv.dev/vulnerability/GHSA-639f-hxcv-84mc · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43003 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43003.yaml · Note
• https://github.com/ikus060/rdiffweb · Note
• https://t.me/cvenotify/40938 · Telegram Post
• https://t.me/cvenotify/40404 · Telegram Post