medium5.3
CVE-2022-3376
rdiffweb allows a new password to be the same as the previous password
Impact
rdiffweb prior to 2.5.0a4 allows users to set their new password to be the same as the old password during a password reset. Version 2.5.0a4 enforces a password policy in which a new password cannot be the same as the old one.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | rdiffweb | < 2.5.0 | 2.5.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ikus-Soft | Rdiffweb | through 2.4.10 Version 2.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ikus060/rdiffweb/commit/2ffc2af65c8f8113b06e0b89929c604bcdf844b9
- https://huntr.dev/bounties/a9021e93-6d18-4ac1-98ce-550c4697a4ed
- https://github.com/advisories/GHSA-7wr6-fj4x-893v
- https://nvd.nist.gov/vuln/detail/CVE-2022-3376
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43157.yaml