{"id":"CVE-2022-4722","aliases":["EUVD-2022-0259","GHSA-wf33-6x33-wcf9","PYSEC-2022-43008"],"status":"published","title":"Authentication Bypass by Primary Weakness in ikus060/rdiffweb","description":"Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.","severity":{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01206,"percentile":0.68582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-305"],"published":"2022-12-23T00:00:00Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"PyPI","package":"rdiffweb","fixed_in":["2.5.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5"}]}],"versions":["0.10.0","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.9.2.dev1","0.9.3","0.9.4","0.9.5","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.1b1","1.3.1b2","1.3.2","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.1b1","1.4.1b2","1.4.1b3","1.5.0","1.5.1b1","1.5.1b2","1.6.0b1","2.0.1b2","2.0.1b3","2.0.2","2.0.3a1","2.0.3a2","2.0.3a3","2.0.3a4","2.0.3a5","2.0.3a6","2.0.3a7","2.1.0","2.2.0","2.2.0.dev1","2.2.0a1","2.2.0a2","2.2.0a3","2.2.0a4","2.2.0a5","2.2.0a6","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.10","2.4.11","2.4.11a1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.0a7","2.5.0a8","2.5.0a9","2.5.1","2.5.2","2.5.3","2.5.4","2.5.4b1"]},{"source":"osv","ecosystem":"PyPI","package":"rdiffweb","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"d1aaa96b665a39fba9e98d6054a9de511ba0a837"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5"}]}],"versions":["0.10.0","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.9.2.dev1","0.9.3","0.9.4","0.9.5","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.1b1","1.3.1b2","1.3.2","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.1b1","1.4.1b2","1.4.1b3","1.5.0","1.5.1b1","1.5.1b2","1.6.0b1","2.0.1b2","2.0.1b3","2.0.2","2.0.3a1","2.0.3a2","2.0.3a3","2.0.3a4","2.0.3a5","2.0.3a6","2.0.3a7","2.1.0","2.2.0","2.2.0.dev1","2.2.0a1","2.2.0a2","2.2.0a3","2.2.0a4","2.2.0a5","2.2.0a6","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.10","2.4.11","2.4.11a1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.0a7","2.5.0a8","2.5.0a9","2.5.1","2.5.2","2.5.3","2.5.4","2.5.4b1","2.0.1","2.0.0","0.9.2","0.9.1","0.8.1","v0.7.0","0.7.0","v0.6.5","v0.6.4"]}],"products":[{"vendor":"ikus-soft","product":"rdiffweb"},{"vendor":"ikus060","product":"ikus060/rdiffweb"}],"references":[{"url":"https://huntr.dev/bounties/c62126dc-d9a6-4d3e-988d-967031876c58","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web","evidence","fix"]},{"url":"https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4722","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43008.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wf33-6x33-wcf9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4722.json","tags":["advisory"]},{"url":"https://github.com/ikus060/rdiffweb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-4722","title":"Authentication Bypass by Primary Weakness in ikus060/rdiffweb","description":"Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.","status":"published","published":"2022-12-23T00:00:00Z","modified":"2025-04-09T20:41:08.079Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-0259","description":"Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.","status":"published","published":"2022-12-23T00:00:00Z","modified":"2025-04-09T20:41:08Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:37.733624Z"}],"ghsa":[{"id":"GHSA-wf33-6x33-wcf9","title":"rdiffweb vulnerable to Authentication Bypass by Primary Weakness","description":"In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations \u0026 may allow unauthorized access.","status":"published","published":"2022-12-27T15:30:19Z","modified":"2024-10-25T21:41:20Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287","CWE-305"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2022-4722","description":"Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.","status":"published","published":"2022-12-27T15:15:11.9Z","modified":"2026-06-17T05:21:39.39Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-305","CWE-287"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-4722","title":"Authentication Bypass by Primary Weakness in ikus060/rdiffweb","description":"Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.","status":"published","published":"2022-12-23T00:00:00Z","modified":"2026-10-28T02:30:34.065605722Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"GHSA-wf33-6x33-wcf9","title":"rdiffweb vulnerable to Authentication Bypass by Primary Weakness","description":"In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations \u0026 may allow unauthorized access.","status":"published","published":"2022-12-27T15:30:19Z","modified":"2024-10-25T22:04:45.032364Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287","CWE-305"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"PYSEC-2022-43008","description":"Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.","status":"published","published":"2022-12-27T15:15:00Z","modified":"2026-06-10T17:02:34.559043448Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}