Paper/Archive/CVE-2022-29622

CVE-2022-29622

mitre — An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename.

EPSS 3%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.7.887 × 2017.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refyoutube.com/watch?v=C6QPKooxhAo refgithub.com/node-formidable/formidable/issues/856 refgithub.com/node-formidable/formidable/issues/862 refmedium.com/%40zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022 refgithub.com/strapi/strapi/issues/20189