CVE-2022-38179 : JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

Published 2022-08-12 10:15:29

Updated 2022-08-16 11:50:42

Source JetBrains s.r.o.

View at NVD, CVE.org

Products affected by CVE-2022-38179

Jetbrains » Ktor
Versions before (<) 2.1.0
cpe:2.3:a:jetbrains:ktor:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.7	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N	1.6	2.7	JetBrains s.r.o.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE-184 Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Assigned by: cve@jetbrains.com (Secondary)
CWE-697 Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Assigned by: nvd@nist.gov (Primary)

https://www.jetbrains.com/privacy-security/issues-fixed/

Fixed security issues
Vendor Advisory

CVEs referencing this url
https://github.com/ktorio/ktor/pull/3110

KTOR-4669 Encode Content-Disposition filename* parameter by e5l · Pull Request #3110 · ktorio/ktor · GitHub
Third Party Advisory

Jump to