CVE-2022-24303

Aliases:GHSA-9j59-75qj-795wBIT-pillow-2022-24303PYSEC-2022-168DEBIAN-CVE-2022-24303ALPINE-CVE-2022-24303
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 28 Mar 2022, 00:00
Last modified:03 Aug 2024, 04:07

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (nvd)
EPSS Score
2.88% LOW
3% probability +1.50%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Mar 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 04:07
Last Modified
Vulnerability information updated

Description

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

CVSS Metrics

  • v4.0•HIGH•Score: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
  • v2.0•MEDIUM•Score: 6.4AV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 2.88%• Percentile: 86%

Affected Systems

  • alpine•py3-pillow

    < 8.4.0-r3

  • debian•pillow

    < 8.1.2+dfsg-0.3+deb11u3 | < 9.0.1-1 | < 9.0.1-1 | < 9.0.1-1

  • fedoraproject•fedora

    34 | 35

  • PyPI•pillow

    < 9.0.1

  • python•pillow

    < 9.0.1

References (18)