A vulnerability was found in deepaliupadhyay RealEstate up to 2018-11-30 and classified as critical. Affected by this issue is the function send_file. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

The weakness was shared 07/11/2022 as 669. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2022-31574 since 05/23/2022. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• deepaliupadhyay

Name

• RealEstate

Version

• 2018-11-30

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion