CVE-2022-3607 : Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/o

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.

Published 2022-10-19 13:15:09

Updated 2022-10-20 19:33:54

Source huntr.dev

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-3607

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 17 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-3607

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.0	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	1.5	4.0	huntr.dev
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None
6.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	1.5	4.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-3607

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

The product does not adequately filter user-controlled input for special elements with control implications.

Assigned by: security@huntr.dev (Secondary)

References for CVE-2022-3607

https://huntr.dev/bounties/2d1db3c9-93e8-4902-a55b-5ea53c22aa11

ZipSlip Symlink variant allows to read any file within OctoPrint Box vulnerability found in octoprint
Exploit;Third Party Advisory
https://github.com/octoprint/octoprint/commit/3cca3a43f3d085e9bbe5a5840c8255bb1b5d052e

🔒️ Close a sanity check hole in language packs · OctoPrint/OctoPrint@3cca3a4 · GitHub
Patch;Third Party Advisory

Products affected by CVE-2022-3607

Octoprint » Octoprint
Versions before (<) 1.8.3
cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-3607

Exploit prediction scoring system (EPSS) score for CVE-2022-3607

CVSS scores for CVE-2022-3607

CWE ids for CVE-2022-3607

References for CVE-2022-3607

Products affected by CVE-2022-3607