rdiffweb contains Weak Password Requirements
rdiffweb version 2.4.1 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3179US | high8.8 | — | ||
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-mp5p-g2jv-r8qwADVISORY
- https://github.com/ikus060/rdiffwebPACKAGE
- https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-272.yamlWEB
- https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5feWEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3179ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan