CVE-2022-31551 is a critical absolute path traversal vulnerability affecting the pleomax00/flask-mongo-skel repository, specifically the flask_mongo_skel_project and flask_mongo_skel products, due to unsafe use of the Flask send_file function. With a CVSS score of 9.3, this network-exploitable vulnerability is easy to execute and could lead to high confidentiality impact and low availability impact. While there is no known active exploitation, Metasploit, Nuclei, or ExploitDB modules, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2012-11-01CPE matchmatch criteria | cpe:2.3:a:flask-mongo-skel_project:flask-mongo-skel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.