Lucene search

GitHub Advisory DatabaseGHSA-CW2V-WV4G-W4P6

HistorySep 18, 2022 - 12:00 a.m.

rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users

2022-09-1800:00:30

CWE-352

GitHub Advisory Database

github.com

rdiffweb

cross-site request forgery

deletion

repositories

users

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

30.0%

JSON

rdiffweb prior to 2.4.5 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker exploiting this vulnerability can use it to delete repositories and users.

Affected configurations

Vulners

Node

rdiffwebrdiffwebRange<2.4.5

VendorProductVersionCPE
rdiffwebrdiffweb*cpe:2.3:a:rdiffweb:rdiffweb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rdiffweb	rdiffweb	*	cpe:2.3:a:rdiffweb:rdiffweb::::::::

References

github.com/advisories/GHSA-cw2v-wv4g-w4p6

github.com/ikus060/rdiffweb/commit/422791ea45713aaaa865bdca74addb9fffd93a71

github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-281.yaml

huntr.dev/bounties/15c8fd98-7f50-4d46-b013-42710af1f99c

nvd.nist.gov/vuln/detail/CVE-2022-3232

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

30.0%

JSON

Related for GHSA-CW2V-WV4G-W4P6