Vulnerability · Published May 12, 2022 · Assigned by @huntrdev
CVE-2022-1044Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk
High 8.2
In plain English
A high-severity security flaw in polonel/trudesk from polonel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.0)8.2High
Exploit odds (30 days)0.9%top 40.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| polonel | polonel/trudesk | unspecified – before v1.2.1 |
Weakness: CWE-922 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
References
- https://huntr.dev/bounties/ff878be9-563a-4d0e-99c1-fc3c767f6d3e x_refsource_CONFIRM
- https://github.com/polonel/trudesk/commit/097b4823935c4fa524e71ab2dd107cf2056922b0 x_refsource_MISC