PT-2023-15901 · Unknown · Abhilash1985 Predictapp

Published 2023-01-16 · Updated 2024-05-17 · CVE-2022-4890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions abhilash1985 PredictApp (affected versions not specified)

Description A critical issue has been found in the Cookie Handler component of abhilash1985 PredictApp, affecting the processing of the file config/initializers/new framework defaults 7 0.rb. The manipulation leads to deserialization and can be initiated remotely.

Recommendations To fix this issue, it is recommended to apply a patch named b067372f3ee26fe1b657121f0f41883ff4461a06. As a temporary workaround, consider restricting access to the vulnerable Cookie Handler component until a patch is applied.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-4890

Affected Products

Abhilash1985 Predictapp

References · 8

• https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06 · Patch
• https://github.com/abhilash1985/PredictApp/pull/73 · Patch
• https://osv.dev/vulnerability/CVE-2022-4890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4890 · Security Note
• https://t.me/cvenotify/42090 · Telegram Post
• https://vuldb.com/?id.218387 · Note
• https://vuldb.com/?ctiid.218387 · Note
• https://t.me/cibsecurity/56531 · Telegram Post