CVE-2022-22701

partkeepr/PartKeepr

on github

Published

January 10, 2022

Severity

CVSS v3:

6.5 MEDIUM

CVSS v2:

4 MEDIUM

Description

PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.

References

https://fluidattacks.com/advisories/hendrix/
https://github.com/partkeepr/PartKeepr/issues/1229

Configurations

CPE23	Version Start	Version End	Exact Version
cpe:2.3:a:partkeepr:partkeepr::::::::	n/a	1.4.0 (including)	*

External Links

NVD - CVE-2022-22701