Vulnerability · Published May 5, 2022 · Assigned by @huntrdev
CVE-2022-1592Server-Side Request Forgery in scout in clinical-genomics/scout
Critical 9.4
In plain English
A critical-severity server-side request forgery in clinical-genomics/scout from clinical-genomics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | scout-browser | 4.52 | GHSA-g53g-q539-93cv |
| PyPI | scout-browser | 4.52 | PYSEC-2026-750 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| clinical-genomics | clinical-genomics/scout | unspecified – before v4.42 |
Weakness: CWE-918 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L