CVE-2022-29622

Katalog CVE

CVSS 9.8 · Critical EPSS 3,4%

Kerentanan Unrestricted Upload of File with Dangerous Type pada formidable project formidable. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Rincian

Terbit di NVD

16 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

3,4% peluang dieksploitasi; lebih tinggi dari 88,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/node-formidable/formidable/issues/856 issue tracking · advisory pihak ketiga
• https://github.com/node-formidable/formidable/issues/862 exploit · issue tracking · advisory pihak ketiga
• https://www.youtube.com/watch?v=C6QPKooxhAo exploit · advisory pihak ketiga
• https://github.com/strapi/strapi/issues/20189
• https://medium.com/%40zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022