Lucene search

GitHub Advisory DatabaseGHSA-7Q4R-X5QG-MMCP

HistoryDec 27, 2022 - 3:30 p.m.

rdiffweb has no rate limit on resend email feature

2022-12-2715:30:19

CWE-770

GitHub Advisory Database

github.com

rdiffweb

security

rate limit

2fa

software

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

32.3%

JSON

rdiffweb prior to 2.5.5 has no rate limit on the “resend email feature” while enable or disable 2FA from /prefs/mfa endpoint .

Affected configurations

Vulners

Node

rdiffwebrdiffwebRange<2.5.5

VendorProductVersionCPE
rdiffwebrdiffweb*cpe:2.3:a:rdiffweb:rdiffweb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rdiffweb	rdiffweb	*	cpe:2.3:a:rdiffweb:rdiffweb::::::::

References

github.com/advisories/GHSA-7q4r-x5qg-mmcp

github.com/ikus060/rdiffweb/commit/6e9ee210548f6d3210704cac302cfc7cdb239765

huntr.dev/bounties/9369681b-8bfc-4146-a54c-c5108442d92c

nvd.nist.gov/vuln/detail/CVE-2022-4723

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

32.3%

JSON

Related for GHSA-7Q4R-X5QG-MMCP