CVE-2022-29351 - Vulnerability Details - OpenCVE

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Tiddlywiki	Tiddlywiki5

Configuration 1 [-]

cpe:2.3:a:tiddlywiki:tiddlywiki5:5.2.2:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://tiddlywiki5.com
https://github.com/Jermolene/TiddlyWiki5
https://github.com/jimcola99/corruptsvgfile
https://www.youtube.com/watch?v=F_DBx4psWns

History

Wed, 20 Nov 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-05-16T13:28:55

Updated: 2024-11-20T15:25:43.265Z

Reserved: 2022-04-16T00:00:00

Link: CVE-2022-29351

Vulnrichment

Updated: 2024-08-03T06:17:54.907Z

NVD

Status : Modified

Published: 2022-05-16T14:15:07.900

Modified: 2024-11-21T06:58:57.137

Link: CVE-2022-29351

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tiddlywiki:tiddlywiki5:5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "A2799D5B-FD3C-461C-9F0B-250240C0357D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here."}, {"lang": "es", "value": "Una vulnerabilidad de carga de archivos arbitraria en el m\u00f3dulo de carga de archivos de Tiddlywiki5 versi\u00f3n v5.2.2, permite a atacantes ejecutar c\u00f3digo arbitrario por medio de un archivo SVG dise\u00f1ado"}], "id": "CVE-2022-29351", "lastModified": "2024-11-21T06:58:57.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-16T14:15:07.900", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link", "Product", "URL Repurposed"], "url": "http://tiddlywiki5.com"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/Jermolene/TiddlyWiki5"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/jimcola99/corruptsvgfile"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=F_DBx4psWns"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Product", "URL Repurposed"], "url": "http://tiddlywiki5.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/Jermolene/TiddlyWiki5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/jimcola99/corruptsvgfile"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=F_DBx4psWns"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}