CVE-2022-31185 Email addresses are not hidden regardless of selected state in mprweb
Attackers can view private email addresses of users who opted to hide them, exposing personal data on the makedeb package repository platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31185?
CVE-2022-31185 is a medium-severity vulnerability in makedeb mprweb, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the `Hide Email Address` checkbox on their account page, or during signup. This could lead to an account's email being leaked, which may be problematic if your email needs to remain private for any reason. Users hosting their own mprweb instance will need to upgrade to the latest commit to get this fixed. Users on the official instance will already have this issue fixed.
Weakness: CWE-200
Which versions are affected by CVE-2022-31185?
It affects 1 product.
Products include Makedp Mprweb.
How do I fix CVE-2022-31185?
No fix has been published for CVE-2022-31185 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-31185 being exploited?
There is no known exploitation of CVE-2022-31185 in the wild and no public exploit code.
Sources
Also known as GHSA-jm39-h693-678g.