CVE-2022-34625

Опубликовано: 02 авг. 2022

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.

Ссылки

https://cwe.mitre.org/data/definitions/1336.html
Third Party Advisory
https://cwe.mitre.org/data/definitions/94.html
Third Party Advisory
https://docs.mealie.io/changelog/v0.5.6/
Release Notes
Vendor Advisory
https://gainsec.com/2022/08/02/cve-2022-34625-ssti-rce-mealie/
Exploit
Third Party Advisory
https://hub.docker.com/r/hkotel/mealie
Product
https://cwe.mitre.org/data/definitions/1336.html
Third Party Advisory
https://cwe.mitre.org/data/definitions/94.html
Third Party Advisory
https://docs.mealie.io/changelog/v0.5.6/
Release Notes
Vendor Advisory
https://gainsec.com/2022/08/02/cve-2022-34625-ssti-rce-mealie/
Exploit
Third Party Advisory
https://hub.docker.com/r/hkotel/mealie
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mealie_project:mealie:1.0.0:beta3:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.0102

Низкий

7.2 High

CVSS3

Дефекты

CWE-94

Связанные уязвимости

GHSA-gx88-675c-vcwx