CVE-2022-31260 Missing authorization in n/a
Attackers can export collection metadata without authentication by exploiting a missing authorization check in the CSV export functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31260?
CVE-2022-31260 is a medium-severity missing authorization vulnerability in n/a, published on 17 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.
Weakness: CWE-306
Which versions are affected by CVE-2022-31260?
1 open source package ship an affected version, including resourcespace. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
resourcespace Bitnami | All versions to 9.8.0 | 9.8.0 |
Products include Montala Resourcespace.
How do I fix CVE-2022-31260?
Upgrade resourcespace to 9.8.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-31260 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31260 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as BIT-resourcespace-2022-31260, GHSA-7v4x-v824-898c.