github - GHSA-m379-x4xc-38x9

GHSA-m379-x4xc-38x9

Vulnerability from github

Published

2022-09-09 00:00

Modified

2022-09-16 17:08

Severity

8.8 (High) - CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames

Details

rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "rdiffweb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-3167"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1021"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T17:08:07Z",
    "nvd_published_at": "2022-09-08T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.",
  "id": "GHSA-m379-x4xc-38x9",
  "modified": "2022-09-16T17:08:07Z",
  "published": "2022-09-09T00:00:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3167"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ikus060/rdiffweb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-268.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames"
}

cve-2022-3167

Vulnerability from cvelistv5

Published

2022-09-08 18:35

Modified

2024-08-03 01:00

Severity

10.0 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb

References

URL	Tags
https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c	x_refsource_CONFIRM
https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428	x_refsource_MISC

Impacted products

Vendor	Product
ikus060	ikus060/rdiffweb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ikus060/rdiffweb",
          "vendor": "ikus060",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-08T18:35:09",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428"
        }
      ],
      "source": {
        "advisory": "e5c2625b-34cc-4805-8223-80f2689e4e5c",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-3167",
          "STATE": "PUBLIC",
          "TITLE": "Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ikus060/rdiffweb",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ikus060"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c"
            },
            {
              "name": "https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428",
              "refsource": "MISC",
              "url": "https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428"
            }
          ]
        },
        "source": {
          "advisory": "e5c2625b-34cc-4805-8223-80f2689e4e5c",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-3167",
    "datePublished": "2022-09-08T18:35:09",
    "dateReserved": "2022-09-08T00:00:00",
    "dateUpdated": "2024-08-03T01:00:10.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

pysec-2022-268

Vulnerability from pysec

Published

2022-09-08 19:15

Modified

2022-09-14 17:03

Details

Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "rdiffweb",
        "purl": "pkg:pypi/rdiffweb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7294bb7466532762c93d711211e5958940c1b428"
            }
          ],
          "repo": "https://github.com/ikus060/rdiffweb",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.0",
        "0.10.2",
        "0.10.3",
        "0.10.4",
        "0.10.5",
        "0.10.6",
        "0.10.7",
        "0.10.8",
        "0.10.9",
        "0.9.2.dev1",
        "0.9.3",
        "0.9.4",
        "0.9.5",
        "1.0.0",
        "1.0.0a1",
        "1.0.0a2",
        "1.0.0a3",
        "1.0.0a4",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.1.0",
        "1.2.0",
        "1.2.1",
        "1.2.2",
        "1.3.0",
        "1.3.1",
        "1.3.1b1",
        "1.3.1b2",
        "1.3.2",
        "1.4.0",
        "1.4.0b1",
        "1.4.0b2",
        "1.4.0b3",
        "1.4.0b4",
        "1.4.0b5",
        "1.4.1b1",
        "1.4.1b2",
        "1.4.1b3",
        "1.5.0",
        "1.5.1b1",
        "1.5.1b2",
        "1.6.0b1",
        "2.0.1b2",
        "2.0.1b3",
        "2.0.2",
        "2.0.3a1",
        "2.0.3a2",
        "2.0.3a3",
        "2.0.3a4",
        "2.0.3a5",
        "2.0.3a6",
        "2.0.3a7",
        "2.1.0",
        "2.2.0",
        "2.2.0.dev1",
        "2.2.0a1",
        "2.2.0a2",
        "2.2.0a3",
        "2.2.0a4",
        "2.2.0a5",
        "2.2.0a6",
        "2.2.1",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.3.7",
        "2.3.8",
        "2.3.9",
        "2.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-3167",
    "GHSA-m379-x4xc-38x9"
  ],
  "details": "Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.",
  "id": "PYSEC-2022-268",
  "modified": "2022-09-14T17:03:43.275428Z",
  "published": "2022-09-08T19:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-m379-x4xc-38x9"
    }
  ]
}

Action not permitted

GHSA-m379-x4xc-38x9

Vulnerability from github

cve-2022-3167

Vulnerability from cvelistv5

pysec-2022-268

Vulnerability from pysec

Tags