CVE-2022-3292
Use of Cache Containing Sensitive Information in ikus060/rdiffweb
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Use of Cache Containing Sensitive Information in ikus060/rdiffweb
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Record
CVE-2022-3292- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
EUVDEUVD-2022-0244
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Record
EUVD-2022-0244- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7fqm-jm52-f9vc
rdiffweb vulnerable to Use of Cache Containing Sensitive Information
rdiffweb prior to version 2.4.9 is vulnerable to Use of Cache Containing Sensitive Information. Due to improper cache control, an attacker can view sensitive information even if they are not logged into an account. Version 2.4.9 contains a patch for this issue.
- Record
GHSA-7fqm-jm52-f9vc- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
NVD
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Record
CVE-2022-3292- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
OSV
Use of Cache Containing Sensitive Information in ikus060/rdiffweb
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Record
CVE-2022-3292- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
OSVGHSA-7fqm-jm52-f9vc
rdiffweb vulnerable to Use of Cache Containing Sensitive Information
rdiffweb prior to version 2.4.9 is vulnerable to Use of Cache Containing Sensitive Information. Due to improper cache control, an attacker can view sensitive information even if they are not logged into an account. Version 2.4.9 contains a patch for this issue.
- Record
GHSA-7fqm-jm52-f9vc- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
OSVPYSEC-2022-296 No score
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Record
PYSEC-2022-296- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rdiffwebPyPI |
before 2.4.9 | 2.4.9 |
rdiffwebPyPI |
before 2.4.9, plus listed versions 0.10.00.10.20.10.30.10.40.10.5 Show 45 moreShow less0.10.60.10.70.10.80.10.90.9.2.dev10.9.30.9.40.9.51.0.01.0.0a11.0.0a21.0.0a31.0.0a41.0.11.0.21.0.31.1.01.2.01.2.11.2.21.3.01.3.11.3.1b11.3.1b21.3.21.4.01.4.0b11.4.0b21.4.0b31.4.0b41.4.0b51.4.1b11.4.1b21.4.1b31.5.01.5.1b11.5.1b21.6.0b12.0.1b22.0.1b32.0.22.0.3a12.0.3a22.0.3a32.0.3a4 |
2.4.9 |
rdiffwebPyPI |
before 2.4.8, plus listed versions 0.10.00.10.20.10.30.10.40.10.5 Show 45 moreShow less0.10.60.10.70.10.80.10.90.9.2.dev10.9.30.9.40.9.51.0.01.0.0a11.0.0a21.0.0a31.0.0a41.0.11.0.21.0.31.1.01.2.01.2.11.2.21.3.01.3.11.3.1b11.3.1b21.3.21.4.01.4.0b11.4.0b21.4.0b31.4.0b41.4.0b51.4.1b11.4.1b21.4.1b31.5.01.5.1b11.5.1b21.6.0b12.0.1b22.0.1b32.0.22.0.3a12.0.3a22.0.3a32.0.3a4 |
2.4.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3292 is a medium vulnerability (CVSS 4.3) in Ikus-soft Rdiffweb, published September 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in rdiffweb 2.4.9.
References
huntr.dev/bounties/e9309018-e94f-4e15-b7d1-5d38b6021c5d
github.com/ikus060/rdiffweb/commit/2406780831618405a13113377a784f3102465f40
nvd.nist.gov/vuln/detail/CVE-2022-3292
Left out here: 73 versions. The JSON record has them.