CVE-2022-3301 : Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.

Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.

Published 2022-09-26 11:15:10

Updated 2022-09-28 18:07:58

Source huntr.dev

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-3301

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 20 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-3301

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
2.4	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	0.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2022-3301

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

Assigned by: security@huntr.dev (Primary)

References for CVE-2022-3301

https://github.com/ikus060/rdiffweb/commit/5ac38b2a75becbab9f948bd5e37ecbcd9f0b362e

Clean-up invalid path on error page · ikus060/rdiffweb@5ac38b2 · GitHub
Patch;Third Party Advisory
https://huntr.dev/bounties/d3bf1e5d-055a-44b8-8d60-54ab966ed63a

Virual defacement allows attacker to display any message of his choice vulnerability found in rdiffweb
Exploit;Patch;Third Party Advisory

Products affected by CVE-2022-3301

Ikus-soft » Rdiffweb
Versions before (<) 2.4.8
cpe:2.3:a:ikus-soft:rdiffweb:*:*:*:*:*:*:*:*
Matching versions