high7.2
CVE-2022-4722
rdiffweb vulnerable to Authentication Bypass by Primary Weakness
Impact
In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | rdiffweb | < 2.5.5 | 2.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ikus-Soft | Rdiffweb | before 2.5.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837
- https://huntr.dev/bounties/c62126dc-d9a6-4d3e-988d-967031876c58
- https://github.com/advisories/GHSA-wf33-6x33-wcf9
- https://nvd.nist.gov/vuln/detail/CVE-2022-4722
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43008.yaml