Vulnerability Details : CVE-2022-45292
Potential exploit
User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.
Products affected by CVE-2022-45292
- cpe:2.3:a:funkwhale:funkwhale:1.2.8:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-45292
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 38 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-45292
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2022-45292
-
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-45292
-
https://dev.funkwhale.audio/funkwhale/funkwhale/-/issues/1952
Funkwhale invites do not permanently expire after being used for signup and can be used again if the user is deleted (#1952) · Issues · funkwhale / funkwhale · GitLabExploit;Issue Tracking;Vendor Advisory
Jump to