CVE-2022-31260

MEDIUMNuclei

ResourceSpace - Metadata Export

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-31260 has a selected CVSS score of 6.5 (medium); EIP currently links 1 Nuclei template.

Description

In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMResourceSpace - Metadata ExportCVSS 6.5

In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.

Impact

Successful exploitation could lead to unauthorized access to sensitive metadata.

Remediation

Apply the vendor-supplied patch or upgrade to the latest version to mitigate CVE-2022-31260.

WeaknessesCWE-306
Authorsritikchaddha
Template tagscvecve2022resourcespacemisconfigvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:*
Shodan: title:"ResourceSpace"
FOFA: title="ResourceSpace"
https://github.com/grymer/CVE/blob/master/CVE-2022-31260.md https://nvd.nist.gov/vuln/detail/CVE-2022-31260

Source: ProjectDiscovery

References

3