CVE-2022-41547

2022-10-1815:15:10

Google

osv.dev

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

65.0%

JSON

Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.

CPENameOperatorVersion
mobile-security-framework-mobsfeq0.8.8.1
mobile-security-framework-mobsfeq0.8.4
mobile-security-framework-mobsfeq0.8.5
mobile-security-framework-mobsfeq0.9
mobile-security-framework-mobsfeq0.8.7
mobile-security-framework-mobsfeq0.9.2
mobile-security-framework-mobsfeq0.9.1
mobile-security-framework-mobsfeq0.8.3
mobile-security-framework-mobsfeq0.8.8
mobile-security-framework-mobsfeq0.8.6

Name	Operator	Version
mobile-security-framework-mobsf	eq	0.8.8.1
mobile-security-framework-mobsf	eq	0.8.4
mobile-security-framework-mobsf	eq	0.8.5
mobile-security-framework-mobsf	eq	0.9
mobile-security-framework-mobsf	eq	0.8.7
mobile-security-framework-mobsf	eq	0.9.2
mobile-security-framework-mobsf	eq	0.9.1
mobile-security-framework-mobsf	eq	0.8.3
mobile-security-framework-mobsf	eq	0.8.8
mobile-security-framework-mobsf	eq	0.8.6

Rows per page:

1-10 of 111

References

github.com/MobSF/Mobile-Security-Framework-MobSF/commit/b9cdd1f52bdf127cf33bb1be369e374a2855f8e6#diff-69d2e38f6bba208c333da6a09a83ca65056fcb60f4e10d23f67c01bcc1ffb58c

github.com/MobSF/Mobile-Security-Framework-MobSF/pull/166