{"id":"CVE-2022-3167","aliases":["EUVD-2022-0228","GHSA-m379-x4xc-38x9","PYSEC-2022-268"],"status":"published","title":"Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb","description":"Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.","severity":{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01191,"percentile":0.6818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1021"],"published":"2022-09-08T18:35:09Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"PyPI","package":"rdiffweb","fixed_in":["2.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1"}]}],"versions":["0.10.0","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.9.2.dev1","0.9.3","0.9.4","0.9.5","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.1b1","1.3.1b2","1.3.2","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.1b1","1.4.1b2","1.4.1b3","1.5.0","1.5.1b1","1.5.1b2","1.6.0b1","2.0.1b2","2.0.1b3","2.0.2","2.0.3a1","2.0.3a2","2.0.3a3","2.0.3a4","2.0.3a5","2.0.3a6","2.0.3a7","2.1.0","2.2.0","2.2.0.dev1","2.2.0a1","2.2.0a2","2.2.0a3","2.2.0a4","2.2.0a5","2.2.0a6","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"7294bb7466532762c93d711211e5958940c1b428"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1"}]}],"versions":["0.10.0","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.9.2.dev1","0.9.3","0.9.4","0.9.5","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.1b1","1.3.1b2","1.3.2","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.1b1","1.4.1b2","1.4.1b3","1.5.0","1.5.1b1","1.5.1b2","1.6.0b1","2.0.1b2","2.0.1b3","2.0.2","2.0.3a1","2.0.3a2","2.0.3a3","2.0.3a4","2.0.3a5","2.0.3a6","2.0.3a7","2.1.0","2.2.0","2.2.0.dev1","2.2.0a1","2.2.0a2","2.2.0a3","2.2.0a4","2.2.0a5","2.2.0a6","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0"]}],"products":[{"vendor":"ikus-soft","product":"rdiffweb"},{"vendor":"ikus060","product":"ikus060/rdiffweb"}],"references":[{"url":"https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3167","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-268.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m379-x4xc-38x9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3167.json","tags":["advisory"]},{"url":"https://github.com/ikus060/rdiffweb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-3167","title":"Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb","description":"Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.","status":"published","published":"2022-09-08T18:35:09Z","modified":"2024-08-03T01:00:10.609Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-0228","description":"Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.","status":"published","published":"2022-09-08T18:35:09Z","modified":"2024-08-03T01:00:10Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:25:57.460299Z"}],"ghsa":[{"id":"GHSA-m379-x4xc-38x9","title":"rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames","description":"rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.","status":"published","published":"2022-09-09T00:00:56Z","modified":"2024-10-25T21:26:51Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2022-3167","description":"Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.","status":"published","published":"2022-09-08T19:15:08.217Z","modified":"2026-06-17T04:58:59.673Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"CVE-2022-3167","title":"Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb","description":"Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.","status":"published","published":"2022-09-08T18:35:09Z","modified":"2026-10-28T02:30:24.263349155Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-m379-x4xc-38x9","title":"rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames","description":"rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.","status":"published","published":"2022-09-09T00:00:56Z","modified":"2024-10-25T21:40:10.566669Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"PYSEC-2022-268","description":"Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.","status":"published","published":"2022-09-08T19:15:00Z","modified":"2023-11-08T04:09:32.146631Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}