{"id":"CVE-2022-3327","published":"2022-10-19T00:00:00Z","modified":"2025-05-09T14:18:42Z","title":"Missing Authentication for Critical Function in ikus060/rdiffweb","vendor":"ikus060","product":"ikus060/rdiffweb","tier":"tail","description":{"text":"Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01004,"percentile":0.6289,"provenance":"source"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://huntr.dev/bounties/02207c8f-2b15-4a31-a86a-74fd2fca0ed1","tags":[]},{"url":"https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095","tags":[]},{"url":"https://huntr.com/bounties/02207c8f-2b15-4a31-a86a-74fd2fca0ed1","tags":["exploit"]}],"priority":{"score":20.7,"factors":[{"name":"EPSS percentile","points":12.58},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.15}]},"vendorSlug":"ikus060","affectedVersions":[{"vendor":"ikus060","product":"ikus060/rdiffweb","versions":[">= unspecified, < 2.5.0a6"]}],"affected":[{"ecosystem":"PyPI","package":"rdiffweb","vulnerableRanges":["<2.5.0","<2.4.10"],"patched":["2.5.0","2.4.10"],"from":["GHSA-99j5-fvg3-54pm","PYSEC-2022-42977"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0249","exploited":false,"provenance":"source"},"exploitRefs":["https://huntr.com/bounties/02207c8f-2b15-4a31-a86a-74fd2fca0ed1"],"lineage":{"familyId":"fam-ikus060-rdiffweb-cve-2022-3364","children":[{"from":"CVE-2022-3327","to":"CVE-2022-3363","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["rdiffweb/core/config.py"],"commits":["https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095","https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2"],"basis":"shared function","functions":["get_parser"]}]},{"from":"CVE-2022-3327","to":"CVE-2022-4644","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["rdiffweb/rdw_app.py"],"commits":["https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095","https://github.com/ikus060/rdiffweb/commit/5f861670ef8f38ca8eea52a98672d0e0fabb5368"],"basis":"rarely changed file"}]},{"from":"CVE-2022-3327","to":"CVE-2022-4646","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["rdiffweb/tools/auth_form.py"],"commits":["https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095","https://github.com/ikus060/rdiffweb/commit/e6f0d8002129be90fe82fa3e3ea0a6942caba398"],"basis":"shared function","functions":["run"]}]}]}}