CVE-2022-37109

camp project camp

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-37109

Katalog CVE

CVSS 9.8 · Critical EPSS 49,5%

Kerentanan Insufficiently Protected Credentials pada camp project camp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the password hash is also used as the cookie secret, so an attacker can generate his own authentication cookie.

Rincian

Terbit di NVD
14 November 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-522: Insufficiently Protected Credentials
EPSS (30 hari)
49,5% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
camp project camp Semua versi sebelum 2022-07-21

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.