GitHub Advisoryadvisory · PyPI

GHSA-wf33-6x33-wcf9 rdiffweb vulnerable to Authentication Bypass by Primary Weakness

HIGH Published 2022-12-27 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-4722
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-305
Reviewed
2022-12-30

Affected packages

• PyPI rdiffweb: < 2.5.5 → fixed in 2.5.5

Description

In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access.

Related

Alias · CVE (1)

  • CVE-2022-4722 Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-305 Authentication Bypass by Primary Weakness weakness

References