{"id":"CVE-2022-3221","aliases":["EUVD-2022-0232","GHSA-vq4h-xrwc-m639","PYSEC-2022-278"],"status":"published","title":"Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb","description":"Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00776,"percentile":0.56055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2022-09-15T08:45:19Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"PyPI","package":"rdiffweb","fixed_in":["2.4.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}],"versions":["0.10.0","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.9.2.dev1","0.9.3","0.9.4","0.9.5","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.1b1","1.3.1b2","1.3.2","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.1b1","1.4.1b2","1.4.1b3","1.5.0","1.5.1b1","1.5.1b2","1.6.0b1","2.0.1b2","2.0.1b3","2.0.2","2.0.3a1","2.0.3a2","2.0.3a3","2.0.3a4","2.0.3a5","2.0.3a6","2.0.3a7","2.1.0","2.2.0","2.2.0.dev1","2.2.0a1","2.2.0a2","2.2.0a3","2.2.0a4","2.2.0a5","2.2.0a6","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2"]},{"source":"osv","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}],"versions":["0.10.0","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.9.2.dev1","0.9.3","0.9.4","0.9.5","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.1b1","1.3.1b2","1.3.2","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.1b1","1.4.1b2","1.4.1b3","1.5.0","1.5.1b1","1.5.1b2","1.6.0b1","2.0.1b2","2.0.1b3","2.0.2","2.0.3a1","2.0.3a2","2.0.3a3","2.0.3a4","2.0.3a5","2.0.3a6","2.0.3a7","2.1.0","2.2.0","2.2.0.dev1","2.2.0a1","2.2.0a2","2.2.0a3","2.2.0a4","2.2.0a5","2.2.0a6","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2"]}],"products":[{"vendor":"ikus-soft","product":"rdiffweb"},{"vendor":"ikus060","product":"ikus060/rdiffweb"}],"references":[{"url":"https://huntr.dev/bounties/1fa1aac9-b16a-4a70-a7da-960b3908ae1d","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/ikus060/rdiffweb/commit/9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3221","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-278.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vq4h-xrwc-m639","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3221.json","tags":["advisory"]},{"url":"https://github.com/ikus060/rdiffweb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-3221","title":"Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb","description":"Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.","status":"published","published":"2022-09-15T08:45:19Z","modified":"2024-08-03T01:00:10.668Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-0232","description":"Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.","status":"published","published":"2022-09-15T08:45:19Z","modified":"2024-08-03T01:00:10Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:57.460299Z"}],"ghsa":[{"id":"GHSA-vq4h-xrwc-m639","title":"rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access","description":"rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.","status":"published","published":"2022-09-16T00:00:39Z","modified":"2024-10-25T21:33:34Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2022-3221","description":"Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.","status":"published","published":"2022-09-15T09:15:09.5Z","modified":"2026-06-17T04:59:06.187Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"CVE-2022-3221","title":"Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb","description":"Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.","status":"published","published":"2022-09-15T08:45:19Z","modified":"2026-10-28T02:30:32.832600687Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"GHSA-vq4h-xrwc-m639","title":"rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access","description":"rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.","status":"published","published":"2022-09-16T00:00:39Z","modified":"2024-10-25T21:41:37.860285Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"PYSEC-2022-278","description":"Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.","status":"published","published":"2022-09-15T09:15:00Z","modified":"2023-11-08T04:09:35.265975Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}