rdiffweb CSRF vulnerability in profile's SSH keys can lead to unauthorized access
High severity
GitHub Reviewed
Published
Sep 16, 2022
to the GitHub Advisory Database
•
Updated Jan 28, 2023
Description
Published by the National Vulnerability Database
Sep 15, 2022
Published to the GitHub Advisory Database
Sep 16, 2022
Reviewed
Sep 16, 2022
Last updated
Jan 28, 2023
rdiffweb prior to 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). While adding SSH public keys to the profile, the server accepts the GET request, which results in adding an SSH public key to the profile and leads to unauthorized access to the system and backups. Version 2.4.3 contains a patch for this issue.
References