CVE-2022-0203 Improper Access Control in crater-invoice/crater
Attackers can access or modify data without proper authorization in the Crater invoicing application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0203?
CVE-2022-0203 is a high-severity missing authorization vulnerability in crater-invoice/crater, published on 26 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
Which versions are affected by CVE-2022-0203?
2 open source packages ship an affected version, including bytefury/crater. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bytefury/crater Packagist | All versions | 6.0.2 |
bytefury/crater Packagist | All versions | 6.0.2 |
Products include Craterapp Crater.
How do I fix CVE-2022-0203?
Upgrade bytefury/crater to 6.0.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-0203 being exploited?
There is no known exploitation of CVE-2022-0203 in the wild and no public exploit code.
Other vulnerabilities in crater-invoice/crater
- CVE-2021-4080 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
- CVE-2022-0372 Cross-site Scripting (XSS) - Stored in crater-invoice/crater
- CVE-2023-46865 Code injection in n/a
- CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater
- CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Sources
Also known as GHSA-xh9g-cp3v-p8q4.