CVE-2022-29622: Malicious File Upload
An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled.
Other sources
Node.js Formidable module could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP request using the filename parameter, an attacker could exploit this vulnerability to upload a malicious PDF file, which could allow the attacker to execute arbitrary code on the vulnerable system.
— IBM
Withdrawn: This advisory was improperly assigned.
An arbitrary file upload vulnerability in formidable v3.2.4 allows attackers to execute arbitrary code via a crafted filename.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29622?
CVE-2022-29622 is classified as a moderate severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2022-29622?
To fix CVE-2022-29622, update the formidable package to version 3.2.4 or later.
Which versions of formidable are affected by CVE-2022-29622?
CVE-2022-29622 affects formidable version 3.1.4 and potentially earlier versions.
What kind of attack is facilitated by CVE-2022-29622?
CVE-2022-29622 allows attackers to execute arbitrary code through crafted filenames uploaded via the vulnerable application.
Are there any applications besides formidable that are affected by CVE-2022-29622?
Yes, IBM Cognos Analytics versions 11.2.0 to 11.2.4 FP3 and 12.0.0 to 12.0.3 are also affected by CVE-2022-29622.