high8.8
CVE-2022-3179
rdiffweb contains Weak Password Requirements
Impact
rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | rdiffweb | = 2.4.1 | 2.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ikus-Soft | Rdiffweb | before 2.4.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5
- https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5fe
- https://github.com/advisories/GHSA-mp5p-g2jv-r8qw
- https://nvd.nist.gov/vuln/detail/CVE-2022-3179
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-272.yaml