Lucene search
HistoryAug 19, 2022 - 2:15 p.m.
CVE-2022-34624
cve-2022-34624
mealie
security
mitm attack
nvd
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
40.6%
Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
Affected configurations
Node
mealiemealieMatch0.5.5
ORmealiemealieMatch1.0.0beta3
| CPE | Name | Operator | Version |
|---|---|---|---|
| mealie:mealie | mealie | eq | 0.5.5 |
| mealie:mealie | mealie | eq | 1.0.0 |
References
Social References
More
Related
nvd
nvd
CVE-2022-34624
2022-08-19 14:15:08
prion
prion
Cross site request forgery (csrf)
2022-08-19 14:15:00
cvelist
cvelist
CVE-2022-34624
2022-08-19 13:22:03
osv
osv
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
40.6%
Related for CVE-2022-34624