{"id":"CVE-2022-3363","published":"2022-10-26T00:00:00Z","modified":"2025-05-07T18:29:04Z","title":"Business Logic Errors in ikus060/rdiffweb","vendor":"ikus060","product":"ikus060/rdiffweb","tier":"tail","description":{"text":"Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.8,"severity":"LOW","version":"3.0","vector":"CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01006,"percentile":0.6293,"provenance":"source"},"cwes":[{"id":"CWE-840","name":"Business Logic Errors"}],"references":[{"url":"https://huntr.dev/bounties/b8a40ba6-2452-4abe-a80a-2d065ee8891e","tags":[]},{"url":"https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2","tags":[]},{"url":"https://huntr.com/bounties/b8a40ba6-2452-4abe-a80a-2d065ee8891e","tags":["exploit"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":12.59},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":1.96}]},"vendorSlug":"ikus060","affectedVersions":[{"vendor":"ikus060","product":"ikus060/rdiffweb","versions":[">= unspecified, < 2.5.0a7"]}],"affected":[{"ecosystem":"PyPI","package":"rdiffweb","vulnerableRanges":["<2.5.0a7","<2.5.0"],"patched":["2.5.0a7","2.5.0"],"from":["GHSA-jw36-mrvg-j5fx","PYSEC-2022-42978"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0250","exploited":false,"provenance":"source"},"exploitRefs":["https://huntr.com/bounties/b8a40ba6-2452-4abe-a80a-2d065ee8891e"],"lineage":{"familyId":"fam-ikus060-rdiffweb-cve-2022-3364","parents":[{"from":"CVE-2022-3438","to":"CVE-2022-3363","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["rdiffweb/core/model/_user.py"],"commits":["https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2","https://github.com/ikus060/rdiffweb/commit/4d464b467f14b8eb9103d7f5f0774e49995527c7"],"basis":"shared function","functions":["UserObject"]}]},{"from":"CVE-2022-3327","to":"CVE-2022-3363","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["rdiffweb/core/config.py"],"commits":["https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095","https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2"],"basis":"shared function","functions":["get_parser"]}]}],"children":[{"from":"CVE-2022-3363","to":"CVE-2022-4018","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["rdiffweb/core/config.py"],"commits":["https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2","https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095"],"basis":"shared function","functions":["get_parser"]}]}],"packageHistory":[{"cve":"CVE-2022-3438","published":"2022-10-10","fixed":"2.5.0a4","kev":false},{"cve":"CVE-2022-3457","published":"2022-10-13","fixed":"2.5.0a5","kev":false},{"cve":"CVE-2022-4018","published":"2022-11-16","fixed":"2.5.0a6","kev":false},{"cve":"CVE-2022-3363","published":"2022-10-26","fixed":"2.5.0a7","kev":false},{"cve":"CVE-2022-4314","published":"2022-12-06","fixed":"2.5.2","kev":false,"link":{"from":"CVE-2022-3363","to":"CVE-2022-4314","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:rdiffweb","fromFixed":"2.5.0a7","toFixed":"2.5.2","daysApart":41}]}},{"cve":"CVE-2022-4644","published":"2022-12-22","fixed":"2.5.4","kev":false},{"cve":"CVE-2022-4646","published":"2022-12-22","fixed":"2.5.4","kev":false}],"package":"PyPI:rdiffweb"}}