Integer Overflow or Wraparound Affecting publify_core package, versions <9.2.10
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.24% (65th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUBLIFYCORE-3230897
- published 15 Jan 2023
- disclosed 15 Jan 2023
- credit Vishal Vishwakarma
Introduced: 15 Jan 2023
CVE-2022-1812 Open this link in a new tabHow to fix?
Upgrade publify_core to version 9.2.10 or higher.
Overview
publify_core is a Core engine for the Publify blogging system, formerly known as Typo.
Affected versions of this package are vulnerable to Integer Overflow or Wraparound in app/models/user.rb, which allows attackers to cause denial of service by supplying an excessively long name value for "first name" or "last name".
References
CVSS Scores
version 3.1