CVE-2022-29622

Publicada el 16 may 2022 · Actualizada el 03 ago 2024

Seguir esta CVE + Monitorear node-formidable

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 3.4%

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Productos afectados

n/a · n/a

Referencias

https://github.com/node-formidable/formidable/issues/856 https://github.com/node-formidable/formidable/issues/862 https://github.com/strapi/strapi/issues/20189 https://medium.com/%40zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022 https://www.youtube.com/watch?v=C6QPKooxhAo