CVE-2022-29622

{"id": "CVE-2022-29622", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-05-16T14:15:08.027", "references": [{"url": "https://github.com/node-formidable/formidable/issues/856", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/node-formidable/formidable/issues/862", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/strapi/strapi/issues/20189", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022", "source": "cve@mitre.org"}, {"url": "https://www.youtube.com/watch?v=C6QPKooxhAo", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en la carga de archivos arbitrarios en formidable v3.1.4 permite a los atacantes ejecutar c\u00f3digo arbitrario a trav\u00e9s de un nombre de archivo manipulado. NOTA: algunas terceras partes disputan este problema porque el producto tiene casos de uso comunes en los que la carga de archivos arbitrarios es el comportamiento deseado. Adem\u00e1s, hay opciones de configuraci\u00f3n en todas las versiones que pueden cambiar el comportamiento por defecto de c\u00f3mo se manejan los archivos"}], "lastModified": "2024-08-03T07:15:33.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:formidable_project:formidable:3.1.4:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "44E34908-D32E-43C1-B0B2-224842AEC60C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}