Code injection

2022-01-1014:12:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.6%

JSON

PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the ‘file://’ URI scheme, allowing an authenticated user to read local files.

CPENameOperatorVersion
partkeeprle1.4.0

CPE	Name	Operator	Version
	partkeepr	le	1.4.0

References

fluidattacks.com/advisories/hendrix/

github.com/partkeepr/PartKeepr/issues/1229