CVE-2022-43984
Last modified
CVE-2022-43984 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.. EPSS estimates a 0.61% chance of exploitation in the next 30 days.
Description
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Spatie | Browsershot | 3.57.3 |
References
- https://fluidattacks.com/advisories/malone/Exploit, Third Party Advisory
- https://fluidattacks.com/advisories/malone/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-43984?
How severe is CVE-2022-43984?
How do I fix CVE-2022-43984?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-43978There is an improper authentication vulnerability in Pandora…3.7
- CVE-2022-43979There is a Path Traversal that leads to a Local File Inclusi…9.8
- CVE-2022-4398Integer Overflow or Wraparound in GitHub repository radareor…7.8
- CVE-2022-43980There is a stored cross-site scripting vulnerability in Pand…5.4
- CVE-2022-43982In Apache Airflow versions prior to 2.4.2, the "Trigger DAG …6.1
- CVE-2022-43983Browsershot version 3.57.2 allows an external attacker to re…8.2
- CVE-2022-43985In Apache Airflow versions prior to 2.4.2, there was an open…6.1
- CVE-2022-43989Password recovery vulnerability in SICK SIM2x00 (ARM) Partnu…7.3
- CVE-2022-4399A vulnerability was found in TicklishHoneyBee nodau. It has …9.8
- CVE-2022-43990Password recovery vulnerability in SICK SIM1012 Partnumber 1…7.3
- CVE-2022-43995Sudo 1.8.0 through 1.9.12, with the crypt() password backend…7.1
- CVE-2022-43996The csaf_provider package before 0.8.2 allows XSS via a craf…5.4
Are you affected by CVE-2022-43984?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST