CVE-2022-22701

Опубликовано: 10 янв. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.

Ссылки

https://fluidattacks.com/advisories/hendrix/
Exploit
Third Party Advisory
https://github.com/partkeepr/PartKeepr/issues/1229
Exploit
Issue Tracking
Third Party Advisory
https://fluidattacks.com/advisories/hendrix/
Exploit
Third Party Advisory
https://github.com/partkeepr/PartKeepr/issues/1229
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:partkeepr:partkeepr:*:*:*:*:*:*:*:*

Версия до 1.4.0 (включая)

EPSS

Процентиль: 51%

0.00278

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-4vq7-xgx9-437g

github

около 4 лет назад