CVE-2022-29622 File upload in n/a
Attackers can execute arbitrary code via crafted filenames in formidable, though maintainers dispute validity due to intended functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29622?
CVE-2022-29622 is a critical vulnerability in n/a, published on 16 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.
Weakness: CWE-434
Which versions are affected by CVE-2022-29622?
It affects 1 product.
Products include Formidable Project Formidable.
How do I fix CVE-2022-29622?
No fix published yet.
Is CVE-2022-29622 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-29622 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2022-29622, ROOT-APP-NPM-CVE-2022-29622.