CVE-2022-4720 - Vulnerability Details - OpenCVE

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Ikus-soft	Rdiffweb

Configuration 1 [-]

cpe:2.3:a:ikus-soft:rdiffweb:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d
https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70

History

Wed, 09 Apr 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-12-23T00:00:00.000Z

Updated: 2025-04-09T20:40:19.211Z

Reserved: 2022-12-23T00:00:00.000Z

Link: CVE-2022-4720

Vulnrichment

Updated: 2024-08-03T01:48:40.269Z

NVD

Status : Modified

Published: 2022-12-27T15:15:11.753

Modified: 2024-11-21T07:35:48.410

Link: CVE-2022-4720

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-4720", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "dateUpdated": "2025-04-09T20:40:19.211Z", "dateReserved": "2022-12-23T00:00:00.000Z", "datePublished": "2022-12-23T00:00:00.000Z"}, "containers": {"cna": {"title": "Open Redirect in ikus060/rdiffweb", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2022-12-23T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5."}], "affected": [{"vendor": "ikus060", "product": "ikus060/rdiffweb", "versions": [{"version": "unspecified", "lessThan": "2.5.5", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d"}, {"url": "https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-601 URL Redirection to Untrusted Site", "cweId": "CWE-601"}]}], "source": {"advisory": "339687af-6e25-4ad8-823d-c097f607ea70", "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:48:40.269Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d", "tags": ["x_transferred"]}, {"url": "https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-09T17:48:42.012160Z", "id": "CVE-2022-4720", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T20:40:19.211Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d", "tags": ["x_transferred"]}, {"url": "https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:48:40.269Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-4720", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-09T17:48:42.012160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T17:48:52.236Z"}}], "cna": {"title": "Open Redirect in ikus060/rdiffweb", "source": {"advisory": "339687af-6e25-4ad8-823d-c097f607ea70", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ikus060", "product": "ikus060/rdiffweb", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.5.5", "versionType": "custom"}]}], "references": [{"url": "https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d"}, {"url": "https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70"}], "descriptions": [{"lang": "en", "value": "Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2022-12-23T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-4720", "state": "PUBLISHED", "dateUpdated": "2025-04-09T20:40:19.211Z", "dateReserved": "2022-12-23T00:00:00.000Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2022-12-23T00:00:00.000Z", "assignerShortName": "@huntrdev"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ikus-soft:rdiffweb:*:*:*:*:*:*:*:*", "matchCriteriaId": "16348FC3-32AD-4A89-937B-E3A5249CE371", "versionEndExcluding": "2.5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5."}, {"lang": "es", "value": "Redireccionamiento abierto en el repositorio de GitHub ikus060/rdiffweb antes de 2.5.5."}], "id": "CVE-2022-4720", "lastModified": "2024-11-21T07:35:48.410", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 4.7, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-27T15:15:11.753", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}