CVE-2022-4768

Dropbox merou SSH Public Key public_key.py add_public_key injection

6.3 Medium

A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.72%Down 0.3 points since Dec 28, 2022

What each source reports

CVE List Score used 6.3

Dropbox merou SSH Public Key public_key.py add_public_key injection

Record: CVE-2022-4768
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-74
Updated: 2026-11-02

EUVDEUVD-2022-52065 6.3

Record: EUVD-2022-52065
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r4w8-5mfm-rhh8 9.8

A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the...

Record: GHSA-r4w8-5mfm-rhh8
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

NVD 6.3

Record: CVE-2022-4768
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-74
Updated: 2026-11-02

OSV 6.3

Dropbox merou SSH Public Key public_key.py add_public_key injection

Record: CVE-2022-4768
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-74
Updated: 2026-11-02

Affected products

dropbox merou

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4768 is a medium vulnerability (CVSS 6.3) in Dropbox Merou, published December 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. No source names a fixed version.