Exploit

CVE-2022-4606

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)

Published: Dec 18, 2022 / Updated: 23mo ago

Original release date: December 28, 2022 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info greenend -- sftpserver ** DISPUTED ** A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE:

The post CPAI-2022-1163 appeared first on Check Point Software .

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.

Original release date: December 28, 2022 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info greenend -- sftpserver ** DISPUTED ** A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE:

CVE Id : CVE-2022-4606 Published Date: 2022-12-22T18:44:00+00:00 PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. inTheWild added a link to an exploit: https://huntr.dev/bounties/3dab0466-c35d-4163-b3c7-a8666e2f7d95

Update Thu Dec 22 13:48:41 UTC 2022