CVE-2022-4768CWE-74

Dropbox merou SSH Public Key public_key.py add_public_key injection

Medium · published December 27, 2022

CVSS v3.1
6.3
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2022-12-27T22:33Z
EPSS history
Timeline
  • 27 DEC 22:33Z
    Dropbox merou SSH Public Key public_key.py add_public_key injection
    cvelistv5