ikus060/rdiffweb · Security
rdiffweb contains Weak Password Requirements
- GHSA ID
- GHSA-mp5p-g2jv-r8qw
- CVE ID
- CVE-2022-3179
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.
CWEs
- CWE-521 · Weak Password Requirements
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-3179 ↗
- https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5 ↗
- https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5fe ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-272.yaml ↗
- https://github.com/advisories/GHSA-mp5p-g2jv-r8qw ↗