CVE-2022-3292: Use of Cache Containing Sensitive Information in ikus060/rdiffweb
First published: Wed Sep 28 2022(Updated: )
rdiffweb prior to version 2.4.9 is vulnerable to Use of Cache Containing Sensitive Information. Due to improper cache control, an attacker can view sensitive information even if they are not logged into an account. Version 2.4.9 contains a patch for this issue.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ikus-soft Rdiffweb | <2.4.8 | |
| pip/rdiffweb | <2.4.9 | 2.4.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ikus060/rdiffweb/commit/2406780831618405a13113377a784f3102465f40
- https://huntr.dev/bounties/e9309018-e94f-4e15-b7d1-5d38b6021c5d
- https://nvd.nist.gov/vuln/detail/CVE-2022-3292
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-296.yaml
- https://github.com/advisories/GHSA-7fqm-jm52-f9vc (Advisory)
Frequently Asked Questions
What is CVE-2022-3292?
CVE-2022-3292 is a vulnerability found in the GitHub repository ikus060/rdiffweb prior to version 2.4.8, which allows the use of cache containing sensitive information.
How severe is CVE-2022-3292?
CVE-2022-3292 has a severity rating of medium with a CVSS score of 4.6.
What is the affected software by CVE-2022-3292?
The affected software by CVE-2022-3292 is Ikus-soft Rdiffweb prior to version 2.4.8.
How can I fix CVE-2022-3292?
To fix CVE-2022-3292, you should update the affected software to version 2.4.8 or later.
Where can I find more information about CVE-2022-3292?
You can find more information about CVE-2022-3292 in the GitHub repository and the huntr.dev bounty page.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/remedy
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7fqm-jm52-f9vc
- alias/CVE-2022-3292
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/ikus-soft
- canonical/ikus-soft rdiffweb
- package-manager/pip