PT-2023-15901 · Unknown · Abhilash1985 Predictapp

CVE-2022-4890 · Published 2023-01-16 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions abhilash1985 PredictApp (affected versions not specified)

Description A critical issue has been found in the Cookie Handler component of abhilash1985 PredictApp, affecting the processing of the file config/initializers/new framework defaults 7 0.rb. The manipulation leads to deserialization and can be initiated remotely.

Recommendations To fix this issue, it is recommended to apply a patch named b067372f3ee26fe1b657121f0f41883ff4461a06. As a temporary workaround, consider restricting access to the vulnerable Cookie Handler component until a patch is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-4890

Affected Products

Abhilash1985 Predictapp

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4890.json · Exploit
• https://github.com/abhilash1985/PredictApp/pull/73 · Patch
• https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4890 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4890 · Vendor Advisory
• https://t.me/cibsecurity/56531 · Telegram Post
• https://vuldb.com/?ctiid.218387 · Note
• https://t.me/cvenotify/42090 · Telegram Post
• https://vuldb.com/?id.218387 · Note