Vulnerability · Published Aug 4, 2022 · Assigned by @huntrdev
CVE-2022-2653Path Traversal in plankanban/planka
High 7.1
In plain English
A high-severity path traversal in plankanban/planka from plankanban. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.0)7.1High
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file in the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| plankanban | plankanban/planka | unspecified – before 1.5.1 |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://huntr.dev/bounties/5dff7cf9-8bb2-4f67-a02d-b94db5009d70 x_refsource_CONFIRM
- https://github.com/plankanban/planka/commit/ac1df5201dfdaf68d37f7e1b272bc137870d7418 x_refsource_MISC