CVE-2022-3273

Advisory

rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-9g3v-v24q-jj5p
• https://nvd.nist.gov/vuln/detail/CVE-2022-3273
• https://github.com/ikus060/rdiffweb/commit/b5e3bb0a98268d18ceead36ab9b2b7eaacd659a8
• https://github.com/ikus060/rdiffweb
• https://huntr.dev/bounties/a6df4bad-3382-4add-8918-760d885690f6
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3273