7

CVE-2022-3274

Exploit

Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ikus-soft ≫ Rdiffweb Version < 2.4.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.319
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
security@huntr.dev 7 1.5 5.5
CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://github.com/ikus060/rdiffweb/commit/e974df75bdbcff3996ad70bd1b4424ec1485ea3f
Patch
Third Party Advisory
https://huntr.dev/bounties/8834c356-4ddb-4be7-898b-d76f480e9c3f
Patch
Third Party Advisory
Exploit