Is CVE-2022-4719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-4719 being exploited in the wild.

How severe is CVE-2022-4719?

Low severity, with a CVSS score of 3, published 27 December 2022.

Which products and versions are affected?

rdiffweb (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.5, GIT:introduced=0,fixed=bc4bed89affcba71251fe54ed10639da9d392c1d|ECOSYSTEM:introduced=0,fixed=2.5.5.

Is there a fix for CVE-2022-4719?

Yes. rdiffweb (PyPI): upgrade to 2.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-4719 attacked?

It is attacked with physical access, in a software library.

Am I affected by CVE-2022-4719?

Check whether you run rdiffweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-4719: PYSEC-2022-43005 - Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.

CVE-2022-4719 · Severity: low · CVSS 3 · Published 2022-12-27

rdiffweb is an open-source backup web interface for the rdiff-backup utility, used to manage and restore file backups remotely. The vulnerability involves business logic errors that could allow an authenticated user with high privileges to perform unauthorized actions or manipulate backup operations, though the exact impact is limited.

Technologies: rdiffweb (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-4719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-4719 being exploited in the wild.
How severe is CVE-2022-4719?: Low severity, with a CVSS score of 3, published 27 December 2022.
Which products and versions are affected?: rdiffweb (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.5, GIT:introduced=0,fixed=bc4bed89affcba71251fe54ed10639da9d392c1d|ECOSYSTEM:introduced=0,fixed=2.5.5.
Is there a fix for CVE-2022-4719?: Yes. rdiffweb (PyPI): upgrade to 2.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-4719 attacked?: It is attacked with physical access, in a software library.
Am I affected by CVE-2022-4719?: Check whether you run rdiffweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rdiffweb (PyPI): upgrade to 2.5.5 or later
```
pip install "rdiffweb>=2.5.5"
```

Technical details

The vulnerability is a business logic error in rdiffweb versions prior to 2.5.5. The attack requires administrative privileges and user interaction (CVSS v3 vector: AV:P/AC:L/PR:H/UI:R), meaning an authenticated high-privileged user must perform a specific action. The patch, released in version 2.5.5, addresses the logic flaw through a commit that adds notification functionality for SSH key changes. The vulnerability affects all versions from 0.x through 2.5.4.

Affected products

rdiffweb contributors rdiffweb before 2.5.5

Identifiers

CVE-2022-4719
GHSA-2wpw-cm9w-v4xm
PYSEC-2022-43005

Timeline

2022-12-27: disclosed
2022-12-27: patched: Fixed in version 2.5.5

References

https://github.com/ikus060/rdiffweb/commit/bc4bed89affcba71251fe54ed10639da9d392c1d

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.