rdiffweb vulnerabilities and fixes

Recent CVEs affecting rdiffweb, with upgrade or downgrade steps. 43 tracked.

rdiffweb has 43 tracked vulnerabilities, 11 critical. A fixed release or vendor patch exists for 43. Most recent: 2023-09-29. Highest priority: CVE-2022-4719 (score 60/100).

• CVE-2023-5289 HIGH 8.8 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
• CVE-2023-4138 MEDIUM 6.5 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
• CVE-2022-4724 CRITICAL 9.8 UPGRADE Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
• CVE-2022-4723 MEDIUM 6.5 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
• CVE-2022-4722 HIGH 7.2 UPGRADE Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
• CVE-2022-4721 MEDIUM 5.4 UPGRADE Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository i
• CVE-2022-4720 MEDIUM 6.1 UPGRADE Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
• CVE-2022-4719 CRITICAL 9.8 UPGRADE Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
• CVE-2022-4646 MEDIUM 6.5 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.
• CVE-2022-4644 MEDIUM 6.1 UPGRADE Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.
• CVE-2022-4314 CRITICAL 9.8 UPGRADE Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.
• CVE-2022-4018 MEDIUM 4.3 UPGRADE Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
• CVE-2022-3457 CRITICAL 9.8 UPGRADE Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
• CVE-2022-3456 CRITICAL 9.8 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
• CVE-2022-3439 CRITICAL 9.8 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
• CVE-2022-3438 MEDIUM 6.1 UPGRADE Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
• CVE-2022-3389 HIGH 7.5 UPGRADE Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.
• CVE-2022-3376 MEDIUM 5.3 UPGRADE Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
• CVE-2022-3371 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
• CVE-2022-3364 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
• CVE-2022-3363 CRITICAL 9.8 UPGRADE Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
• CVE-2022-3362 CRITICAL 9.8 UPGRADE Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
• CVE-2022-3327 CRITICAL 9.8 UPGRADE Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
• CVE-2022-3326 MEDIUM 4.3 UPGRADE Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
• CVE-2022-3301 LOW 2.4 UPGRADE Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.
• CVE-2022-3298 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
• CVE-2022-3295 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
• CVE-2022-3292 MEDIUM 4.6 UPGRADE Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
• CVE-2022-3290 HIGH 7.5 UPGRADE Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
• CVE-2022-3274 LOW 3.5 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
• CVE-2022-3273 CRITICAL 9.8 UPGRADE Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
• CVE-2022-3272 HIGH 7.5 UPGRADE Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
• CVE-2022-3269 CRITICAL 9.8 UPGRADE Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
• CVE-2022-3267 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
• CVE-2022-3250 MEDIUM 5.3 UPGRADE Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.
• CVE-2022-3233 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
• CVE-2022-3232 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.
• CVE-2022-3221 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.
• CVE-2022-3179 HIGH 8.8 UPGRADE Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
• CVE-2022-3175 MEDIUM 5.3 UPGRADE Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
• CVE-2022-3174 HIGH 7.5 UPGRADE Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.
• CVE-2022-3167 HIGH 8.8 UPGRADE Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
• CVE-2007-2747 MEDIUM 5.0 UPGRADE Directory traversal vulnerability in rdw_helpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read

FAQ

How do I fix rdiffweb vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is rdiffweb being exploited right now?

None of the tracked rdiffweb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which rdiffweb CVE should I patch first?

CVE-2022-4719 currently ranks highest (60/100): Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5..

RSS feed for rdiffweb · ← Back to latest CVEs