GitHub Advisoryadvisory · PyPI

GHSA-vq4h-xrwc-m639 rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access

HIGH Published 2022-09-16 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-3221
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-09-16

Affected packages

• PyPI rdiffweb: < 2.4.3 → fixed in 2.4.3

Description

rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.

Related

Alias · CVE (1)

  • CVE-2022-3221 Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References