CVE-2022-22701

PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.
References
Link Resource
https://fluidattacks.com/advisories/hendrix/ Exploit Third Party Advisory
https://github.com/partkeepr/PartKeepr/issues/1229 Exploit Issue Tracking Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:partkeepr:partkeepr:*:*:*:*:*:*:*:*

Information

Published : 2022-01-10 06:12

Updated : 2022-01-19 06:14


NVD link : CVE-2022-22701

Mitre link : CVE-2022-22701


JSON object : View

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

dedicated server usa

Products Affected

partkeepr

  • partkeepr