CVE-2022-36082 mangadex-downloader vulnerable to unauthorized file reading
Attackers can read local files by providing a web URL to the file command, exposing sensitive data on the user's system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36082?
CVE-2022-36082 is a medium-severity path traversal vulnerability in mansuf mangadex-downloader, published on 7 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue.
Weakness: CWE-20
Which versions are affected by CVE-2022-36082?
3 open source packages ship an affected version, including mangadex-downloader. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mangadex-downloader PyPI | From 1.3.0 | 1.7.2 |
mangadex-downloader PyPI | From 1.3.0 | 1.7.2 |
mangadex-downloader PyPI | From 1.3.0 | 1.7.2 |
Products include Mangadex-Downloader Project Mangadex-Downloader.
How do I fix CVE-2022-36082?
Upgrade mangadex-downloader to 1.7.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-36082 being exploited?
There is no known exploitation of CVE-2022-36082 in the wild and no public exploit code.
Sources
Also known as GHSA-r9x7-2xmr-v8fw, PYSEC-2022-264.