CVE-2022-41547

2022-10-1815:15:10

Google

osv.dev

mobile security framework

lfi vulnerability

staticanalyzer/views.py

http request

arbitrary files

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

65.1%

JSON

Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.

CPENameOperatorVersion
mobile-security-framework-mobsfeq0.8.8.1
mobile-security-framework-mobsfeq0.8.4
mobile-security-framework-mobsfeq0.8.5
mobile-security-framework-mobsfeq0.9
mobile-security-framework-mobsfeq0.8.7
mobile-security-framework-mobsfeq0.9.2
mobile-security-framework-mobsfeq0.9.1
mobile-security-framework-mobsfeq0.8.3
mobile-security-framework-mobsfeq0.8.8
mobile-security-framework-mobsfeq0.8.6

Name	Operator	Version
mobile-security-framework-mobsf	eq	0.8.8.1
mobile-security-framework-mobsf	eq	0.8.4
mobile-security-framework-mobsf	eq	0.8.5
mobile-security-framework-mobsf	eq	0.9
mobile-security-framework-mobsf	eq	0.8.7
mobile-security-framework-mobsf	eq	0.9.2
mobile-security-framework-mobsf	eq	0.9.1
mobile-security-framework-mobsf	eq	0.8.3
mobile-security-framework-mobsf	eq	0.8.8
mobile-security-framework-mobsf	eq	0.8.6

Rows per page:

1-10 of 111

References

github.com/MobSF/Mobile-Security-Framework-MobSF/commit/b9cdd1f52bdf127cf33bb1be369e374a2855f8e6#diff-69d2e38f6bba208c333da6a09a83ca65056fcb60f4e10d23f67c01bcc1ffb58c

github.com/MobSF/Mobile-Security-Framework-MobSF/pull/166