CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater
An attacker can execute arbitrary code by uploading a malicious module file due to insecure deserialization in the Crater invoicing application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1032?
CVE-2022-1032 is a high-severity unsafe deserialization vulnerability in crater-invoice/crater, published on 29 Mar 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
Weakness: CWE-502
Which versions are affected by CVE-2022-1032?
It affects 1 product.
Products include Craterapp Crater.
How do I fix CVE-2022-1032?
No fix has been published for CVE-2022-1032 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-1032 being exploited?
There is no known exploitation of CVE-2022-1032 in the wild and no public exploit code.
Other vulnerabilities in crater-invoice/crater
- CVE-2021-4080 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
- CVE-2022-0372 Cross-site Scripting (XSS) - Stored in crater-invoice/crater
- CVE-2022-0203 Improper Access Control in crater-invoice/crater
- CVE-2023-46865 Code injection in n/a
- CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Sources
Also known as GHSA-g9rc-6mw4-jrq3.