Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-1554

CVE-2022-1554: Path Traversal in scout-browser

6.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2022-1554
GHSA ID
GHSA-694v-63fq-fmr4
EPSS Score
0.67934%
CWE
CWE-22
Published
5/4/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
scout-browserpip< 4.524.52

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the remote_static endpoint handling file requests. Prior to the patch, it directly used request.args.get('file') as input for send_file without proper path validation or authentication checks. The GitHub advisory explicitly mentions the send_file call as the root cause, and the patch adds session-based authorization checks and path validation. The CWE-22/36 mapping confirms this is a path traversal vulnerability enabled by improper input sanitization in file handling functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

S*out is * V*ri*nt **ll *orm*t (V**) visu*liz*tion int*r****. T** Pypi p**k*** `s*out-*rows*r` is vuln*r**l* to p*t* tr*v*rs*l *u* to `s*n*_*il*` **ll in v*rsions prior to *.**.

Reasoning

T** vuln*r**ility st*ms *rom t** r*mot*_st*ti* *n*point **n*lin* *il* r*qu*sts. Prior to t** p*t**, it *ir**tly us** r*qu*st.*r*s.**t('*il*') *s input *or s*n*_*il* wit*out prop*r p*t* v*li**tion or *ut**nti**tion ****ks. T** *it*u* **visory *xpli*it