Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12cTRoLXhyd2MtbTYzOc4AAu0X

rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access

rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.

Permalink: https://github.com/advisories/GHSA-vq4h-xrwc-m639
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cTRoLXhyd2MtbTYzOc4AAu0X
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 8 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-vq4h-xrwc-m639, CVE-2022-3221
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-3221
• https://github.com/ikus060/rdiffweb/commit/9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73
• https://huntr.dev/bounties/1fa1aac9-b16a-4a70-a7da-960b3908ae1d
• https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-278.yaml
• https://github.com/advisories/GHSA-vq4h-xrwc-m639

Affected Packages