Security readout for executives and security teams
Plain-English summary
CVE-2022-3267 is a CSRF flaw in ikus060/rdiffweb before version 2.4.6. If abused, a user’s browser could be made to send unintended requests to rdiffweb. The CVSS score is medium, but the confidentiality impact is marked high, so exposed installations should be upgraded promptly.
Executive priority
Prioritize remediation during the next normal vulnerability cycle, sooner for externally reachable or sensitive backup management environments. This is not confirmed actively exploited, but backup interfaces can expose sensitive operational data.
Technical view
The record identifies CWE-352 in the ikus060/rdiffweb GitHub repository prior to 2.4.6. The CVSS 3.0 vector is AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L, indicating required user interaction, low attack complexity, and potential confidentiality impact. No CPEs or detailed affected version ranges are provided.
Likely exposure
Exposure is limited to organizations running rdiffweb before 2.4.6. Public sources do not identify broader downstream products, hosted services, OS packages, or CPE matches. Internet-facing or broadly reachable rdiffweb deployments carry higher practical risk.
Exploitation context
The provided bundle does not show CISA KEV listing or active exploitation evidence. The weakness class implies browser-mediated abuse of a user session, but the sources do not provide confirmed exploitation, exploit maturity, or incident reporting.
Researcher notes
The source bundle is sparse: it gives the affected project, CWE, fixed-version boundary, CVSS vector, huntr report, and GitHub commit. It does not provide detailed endpoint scope, exploit status, package metadata, or vendor advisory text beyond the references.
Mitigation direction
- Upgrade rdiffweb to version 2.4.6 or later.
- Check vendor release notes and commit history for complete remediation guidance.
- Restrict rdiffweb access to trusted networks and authenticated users.
- Review session and CSRF protection settings after upgrading.
Validation and detection
- Inventory all rdiffweb deployments and record running versions.
- Confirm no deployment remains below version 2.4.6.
- Review application logs for unusual state-changing requests tied to user sessions.
- Verify administrative workflows still require intended user actions after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-3267 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L2.14.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.8MediumVector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://huntr.dev/bounties/7b6ec9f4-4fe9-4716-8dba-3491ffa3f6f2CVE reference · x_refsource_CONFIRM
- https://github.com/ikus060/rdiffweb/commit/20fc0d304412cc569b21f31e52cb8b94094d6314CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.