GHSA-gmj8-84r4-h46j

    Dashboard / Vulnerabilities / GHSA-gmj8-84r4-h46j

    GHSA-gmj8-84r4-h46j

    Published: 23 Sept 2022Last Modified: 25 Oct 2024

    Summary: rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed

    Details: rdiffwen prior to version 2.4.7 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can change a user's email ID. Version 2.4.7 has a fix for this issue.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-3274, https://github.com/ikus060/rdiffweb/commit/e974df75bdbcff3996ad70bd1b4424ec1485ea3f, https://github.com/ikus060/rdiffweb, https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-289.yaml, https://huntr.dev/bounties/8834c356-4ddb-4be7-898b-d76f480e9c3f

    Affected packages

    Package

    Name: rdiffweb

    Purl: pkg:pypi/rdiffweb

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.4.7

    Affected versions

    0.10.0
    0.10.2
    0.10.3
    0.10.4
    0.10.5
    0.10.6
    0.10.7
    0.10.8
    0.10.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gmj8-84r4-h46j | CVE-DB