Vulnerability-Lookup

GHSA-CR9C-RHQ6-VH53

Vulnerability from github – Published: 2022-05-17 00:01 – Updated: 2024-05-17 18:36

Summary

Withdrawn: Code execution via SVG file upload in tiddlywiki

Details

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information.

Original Description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tiddlywiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-29351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-25T20:13:42Z",
    "nvd_published_at": "2022-05-16T14:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "## Withdrawn Advisory\nThis advisory has been withdrawn because it has been found to not be valid. Please see the issue [here](https://github.com/Jermolene/TiddlyWiki5/issues/7384) for more information.\n\n## Original Description\n\nAn arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.",
  "id": "GHSA-cr9c-rhq6-vh53",
  "modified": "2024-05-17T18:36:05Z",
  "published": "2022-05-17T00:01:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29351"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Jermolene/TiddlyWiki5/issues/7384"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Jermolene/TiddlyWiki5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jimcola99/corruptsvgfile"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=F_DBx4psWns"
    },
    {
      "type": "WEB",
      "url": "http://tiddlywiki5.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Withdrawn: Code execution via SVG file upload in tiddlywiki",
  "withdrawn": "2024-05-17T18:36:05Z"
}

CVE-2022-29351 (GCVE-0-2022-29351)

Vulnerability from cvelistv5 – Published: 2022-05-16 13:28 – Updated: 2024-11-20 15:25 Disputed

Summary

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://github.com/jimcola99/corruptsvgfile
	http://tiddlywiki5.com
	https://github.com/Jermolene/TiddlyWiki5
	https://www.youtube.com/watch?v=F_DBx4psWns

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:17:54.907Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jimcola99/corruptsvgfile"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://tiddlywiki5.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Jermolene/TiddlyWiki5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.youtube.com/watch?v=F_DBx4psWns"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T15:24:13.774867Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T15:25:43.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-09T21:45:21.590Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/jimcola99/corruptsvgfile"
        },
        {
          "url": "http://tiddlywiki5.com"
        },
        {
          "url": "https://github.com/Jermolene/TiddlyWiki5"
        },
        {
          "url": "https://www.youtube.com/watch?v=F_DBx4psWns"
        }
      ],
      "tags": [
        "disputed"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-29351",
    "datePublished": "2022-05-16T13:28:55.000Z",
    "dateReserved": "2022-04-16T00:00:00.000Z",
    "dateUpdated": "2024-11-20T15:25:43.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted