PyPI: inventree
CVE-2022-2111
Safety vulnerability ID: SFTY-20220617-44829
Safety legacy ID: pyup.io-54084
Inventree 0.7.2 includes a fix for CVE-2022-2111: Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
Overview
Unrestricted Attachment Upload
Advisory
Inventree 0.7.2 includes a fix for CVE-2022-2111: Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
How to Fix
Upgradeinventreeto0.7.2or higher.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20220617-44829/CVE-2022-2111
- https://github.com/inventree/InvenTree/security/advisories/GHSA-fr2w-mp56-g4xp
- https://nvd.nist.gov/vuln/detail/CVE-2022-2111
- https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f
- https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1
- https://github.com/advisories/GHSA-fr2w-mp56-g4xp
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more