deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38118
Published: 2022-08-30
Description: OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/0a893178-5c64-4f1c-87f1-95cbf1e17c87; https://www.twcert.org.tw/tw/cp-132-6461-25c4b-1.html; https://www.chtsecurity.com/news/0a893178-5c64-4f1c-87f1-95cbf1e17c87
CVE: CVE-2022-39028
Published: 2022-08-30
Description: telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289; https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html; https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html
CVE: CVE-2021-46837
Published: 2022-08-30
Description: res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://downloads.asterisk.org/pub/security/AST-2021-006.html; https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html; https://www.debian.org/security/2022/dsa-5285
CVE: CVE-2022-2330
Published: 2022-08-30
Description: Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10386; https://kcm.trellix.com/corporate/index?page=content&id=SB10386
CVE: CVE-2022-3022
Published: 2022-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-3063
Published: 2022-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-37149
Published: 2022-08-30
Description: WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows attackers to execute arbitrary commands via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/fxc233/iot-vul/blob/main/WAVLINK/WN575A3/Readme.md; https://github.com/fxc233/iot-vul/blob/main/WAVLINK/WN575A3/Readme.md
CVE: CVE-2022-36552
Published: 2022-08-30
Description: Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: http://ac6ac1200.com; http://tenda.com; https://drive.google.com/drive/folders/1VxR4lhaWNWLuAPdJK2aRF6zfo_mRyiFO?usp=sharing
CVE: CVE-2022-37176
Published: 2022-08-30
Description: Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into open security mode via a crafted packet sent to goform/setWizard.
CVSS Score: 9.8 (CRITICAL)
References: http://ac6ac1200.com; http://tenda.com; https://drive.google.com/drive/folders/1L6ojSooP8sbZLQYRsAxlb0IWVAZef8Z7?usp=sharing
CVE: CVE-2022-37237
Published: 2022-08-30
Description: An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327.
CVSS Score: 7.5 (HIGH)
References: https://github.com/ZLMediaKit/ZLMediaKit/issues/1839; https://github.com/ZLMediaKit/ZLMediaKit/issues/1839
CVE: CVE-2021-29864
Published: 2022-08-30
Description: IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 206089
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/206089; https://www.ibm.com/support/pages/node/6616101; https://exchange.xforce.ibmcloud.com/vulnerabilities/206089
CVE: CVE-2022-31232
Published: 2022-08-30
Description: SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access and perform actions on the affected system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000201667/dsa-2022-156-dell-emc-smartfabric-storage-software-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201667/dsa-2022-156-dell-emc-smartfabric-storage-software-security-update-for-multiple-component-vulnerabilities
CVE: CVE-2022-33935
Published: 2022-08-30
Description: Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000201824/dsa-2022-107-dell-emc-data-protection-advisor-dpa-security-update-for-stored-cross-site-scripting-vulnerability; https://www.dell.com/support/kbdoc/en-us/000201824/dsa-2022-107-dell-emc-data-protection-advisor-dpa-security-update-for-stored-cross-site-scripting-vulnerability
CVE: CVE-2022-34368
Published: 2022-08-30
Description: Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. Authenticated non admin user could exploit this vulnerability and gain access to restricted resources.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://www.dell.com/support/kbdoc/en-us/000201652/dsa-2022-194-dell-emc-networker-security-update-for-insufficient-privileges-vulnerability; https://www.dell.com/support/kbdoc/en-us/000201652/dsa-2022-194-dell-emc-networker-security-update-for-insufficient-privileges-vulnerability
CVE: CVE-2022-34374
Published: 2022-08-30
Description: Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to to execute arbitrary OS commands on the affected system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000201835/dsa-2022-202-dell-container-storage-modules-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201835/dsa-2022-202-dell-container-storage-modules-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-34375
Published: 2022-08-30
Description: Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to unintentional access to path outside of restricted directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000201835/dsa-2022-202-dell-container-storage-modules-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201835/dsa-2022-202-dell-container-storage-modules-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-36561
Published: 2022-08-30
Description: XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
CVSS Score: 5.5 (MEDIUM)
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42308; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42308
CVE: CVE-2022-36562
Published: 2022-08-30
Description: Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVSS Score: 8.8 (HIGH)
References: https://github.com/ycdxsb/Vuln/blob/main/RubyInstaller2-Vuln; https://github.com/ycdxsb/Vuln/blob/main/RubyInstaller2-Vuln
CVE: CVE-2022-36563
Published: 2022-08-30
Description: Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVSS Score: 8.8 (HIGH)
References: https://github.com/ycdxsb/Vuln/blob/main/Railsinstaller-Vuln/Railsinstaller-Vuln.md; https://github.com/ycdxsb/Vuln/blob/main/Railsinstaller-Vuln/Railsinstaller-Vuln.md
CVE: CVE-2022-36564
Published: 2022-08-30
Description: Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVSS Score: 8.8 (HIGH)
References: https://github.com/ycdxsb/Vuln/blob/main/StrawberryPerl-Vuln/StrawberryPerl-Vuln.md; https://github.com/ycdxsb/Vuln/blob/main/StrawberryPerl-Vuln/StrawberryPerl-Vuln.md
CVE: CVE-2022-36565
Published: 2022-08-30
Description: Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVSS Score: 8.8 (HIGH)
References: https://github.com/ycdxsb/Vuln/blob/main/Wamp-Vuln/Wamp-Vuln.md; https://github.com/ycdxsb/Vuln/blob/main/Wamp-Vuln/Wamp-Vuln.md
CVE: CVE-2022-36657
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/z1pwn/bug_report/blob/main/vendors/kingbhob02/library-management-system/XSS-1.md; https://github.com/z1pwn/bug_report/blob/main/vendors/kingbhob02/library-management-system/XSS-1.md
CVE: CVE-2022-36730
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-20.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-20.md
CVE: CVE-2022-36731
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-21.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-21.md
CVE: CVE-2022-36732
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-19.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-19.md
CVE: CVE-2022-36733
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-22.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-22.md
CVE: CVE-2022-36734
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-24.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-24.md
CVE: CVE-2022-36735
Published: 2022-08-30
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-23.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-23.md
CVE: CVE-2022-37172
Published: 2022-08-30
Description: Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVSS Score: 7.8 (HIGH)
References: https://github.com/ycdxsb/Vuln/tree/main/Msys2-Vuln; https://github.com/ycdxsb/Vuln/tree/main/Msys2-Vuln
CVE: CVE-2022-37173
Published: 2022-08-30
Description: An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/ycdxsb/Vuln/tree/main/Gvim-Installer-Vuln; https://github.com/ycdxsb/Vuln/tree/main/Gvim-Installer-Vuln
CVE: CVE-2022-3037
Published: 2022-08-30
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0322.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/vim/vim/commit/4f1b083be43f351bc107541e7b0c9655a5d2c0bb; https://huntr.dev/bounties/af4c2f2d-d754-4607-b565-9e92f3f717b5; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RY3GEN2Q46ZJKSNHTN2XB6B3VAJBEILN/
CVE: CVE-2022-27560
Published: 2022-08-30
Description: HCL VersionVault Express exposes administrator credentials.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100150; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100150
CVE: CVE-2022-27563
Published: 2022-08-30
Description: An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100274; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100274
CVE: CVE-2022-36745
Published: 2022-08-30
Description: LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/pull/14126; https://github.com/librenms/librenms/pull/14126
CVE: CVE-2022-36746
Published: 2022-08-30
Description: LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/pull/14126; https://github.com/librenms/librenms/pull/14126
CVE: CVE-2022-36747
Published: 2022-08-30
Description: Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/enferas/b00038c9add210ab639c13e0729425c9; https://github.com/cobub/razor/issues/176; https://gist.github.com/enferas/b00038c9add210ab639c13e0729425c9
CVE: CVE-2022-36748
Published: 2022-08-30
Description: PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xiebruce/PicUploader/issues/80; https://github.com/xiebruce/PicUploader/issues/80
CVE: CVE-2022-36749
Published: 2022-08-30
Description: RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/1859; https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/1859
CVE: CVE-2022-39046
Published: 2022-08-31
Description: An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2024/Feb/3; http://www.openwall.com/lists/oss-security/2024/01/30/6
CVE: CVE-2022-39047
Published: 2022-08-31
Description: Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2022/08/31/1; https://bugs.debian.org/1017579; https://osdn.net/projects/freeciv/ticket/45299
CVE: CVE-2022-37021
Published: 2022-08-31
Description: Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr; https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr
CVE: CVE-2022-37022
Published: 2022-08-31
Description: Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4m; https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4m
CVE: CVE-2022-37023
Published: 2022-08-31
Description: Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj; https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj
CVE: CVE-2022-27911
Published: 2022-08-31
Description: An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.
CVSS Score: 5.3 (MEDIUM)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-multiple-full-path-disclosures-because-of-missing-jexec-or-die-check.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-multiple-full-path-disclosures-because-of-missing-jexec-or-die-check.html
CVE: CVE-2022-36035
Published: 2022-08-31
Description: Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allows other applications to replace the Flux deployment information with arbitrary content which is deployed into the target Kubernetes cluster instead. The vulnerability is due to the improper handling of user-supplied input, which results in a path traversal that can be controlled by the attacker. Users sharing the same shell between other applications and the Flux CLI commands could be affected by this vulnerability. In some scenarios no errors may be presented, which may cause end users not to realize that something is amiss. A safe workaround is to execute Flux CLI in ephemeral and isolated shell environments, which can ensure no persistent values exist from previous processes. However, upgrading to the latest version of the CLI is still the recommended mitigation strategy.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://github.com/fluxcd/flux2/releases/tag/v0.32.0; https://github.com/fluxcd/flux2/security/advisories/GHSA-xwf3-6rgv-939r; https://github.com/fluxcd/flux2/releases/tag/v0.32.0