CVE-2022-3269
Session Fixation in ikus060/rdiffweb
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Session Fixation in ikus060/rdiffweb
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Record
CVE-2022-3269- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2022-0238
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Record
EUVD-2022-0238- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j3q4-gmj4-mj95
rdiffweb vulnerable to account access via session fixation
rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the browser and after password reset. The same cookies are reassigned for additional user logins which can lead to session fixation. An attacker can gain unauthorized access to the account of users who are using the same browser as long as a single session cookie persists on that browser once the attacker obtains a session cookie through another attack. This issue is patched in version 2.4.7. There are no known workarounds.
- Record
GHSA-j3q4-gmj4-mj95- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Record
CVE-2022-3269- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
Session Fixation in ikus060/rdiffweb
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Record
CVE-2022-3269- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-j3q4-gmj4-mj95
rdiffweb vulnerable to account access via session fixation
rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the browser and after password reset. The same cookies are reassigned for additional user logins which can lead to session fixation. An attacker can gain unauthorized access to the account of users who are using the same browser as long as a single session cookie persists on that browser once the attacker obtains a session cookie through another attack. This issue is patched in version 2.4.7. There are no known workarounds.
- Record
GHSA-j3q4-gmj4-mj95- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVPYSEC-2022-290 No score
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Record
PYSEC-2022-290- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rdiffwebPyPI |
before 2.4.7 | 2.4.7 |
rdiffwebPyPI |
before 2.4.7, plus listed versions 0.10.00.10.20.10.30.10.40.10.5 Show 45 moreShow less0.10.60.10.70.10.80.10.90.9.2.dev10.9.30.9.40.9.51.0.01.0.0a11.0.0a21.0.0a31.0.0a41.0.11.0.21.0.31.1.01.2.01.2.11.2.21.3.01.3.11.3.1b11.3.1b21.3.21.4.01.4.0b11.4.0b21.4.0b31.4.0b41.4.0b51.4.1b11.4.1b21.4.1b31.5.01.5.1b11.5.1b21.6.0b12.0.1b22.0.1b32.0.22.0.3a12.0.3a22.0.3a32.0.3a4 |
2.4.7 |
rdiffwebPyPI |
before 2.4.7, plus listed versions 0.10.00.10.20.10.30.10.40.10.5 Show 45 moreShow less0.10.60.10.70.10.80.10.90.9.2.dev10.9.30.9.40.9.51.0.01.0.0a11.0.0a21.0.0a31.0.0a41.0.11.0.21.0.31.1.01.2.01.2.11.2.21.3.01.3.11.3.1b11.3.1b21.3.21.4.01.4.0b11.4.0b21.4.0b31.4.0b41.4.0b51.4.1b11.4.1b21.4.1b31.5.01.5.1b11.5.1b21.6.0b12.0.1b22.0.1b32.0.22.0.3a12.0.3a22.0.3a32.0.3a4 |
2.4.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3269 is a medium vulnerability (CVSS 6.4) in Ikus-soft Rdiffweb, published September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in rdiffweb 2.4.7.
References
huntr.dev/bounties/67c25969-5e7a-4424-817e-e1a918f63cc6
github.com/ikus060/rdiffweb/commit/39e7dcd4a1f44d2a7bd92b79d78a800910b1b22b
nvd.nist.gov/vuln/detail/CVE-2022-3269
Left out here: 69 versions. The JSON record has them.