CVE-2022-46165

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-46165
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46165.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-46165
Aliases
Related
Published
2023-06-06T18:15:10Z
Modified
2024-09-18T03:22:25.329092Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.

References

Affected packages

Debian:11 / syncthing

Package

Name
syncthing
Purl
pkg:deb/debian/syncthing?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.12.1~ds1-4
1.18.0~ds1-1
1.18.0~ds1-2
1.18.0~ds1-3
1.18.6~ds1-1~bpo11+1
1.18.6~ds1-1~bpo11+2
1.18.6~ds1-1
1.18.6~ds1-2
1.19.2~ds1-1~bpo11+1
1.19.2~ds1-1
1.19.2~ds1-2
1.19.2~ds1-3
1.27.2~ds4-1
1.27.7~ds1-1
1.27.7~ds1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / syncthing

Package

Name
syncthing
Purl
pkg:deb/debian/syncthing?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.19.2~ds1-1
1.19.2~ds1-2
1.19.2~ds1-3
1.27.2~ds4-1
1.27.7~ds1-1
1.27.7~ds1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / syncthing

Package

Name
syncthing
Purl
pkg:deb/debian/syncthing?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.27.2~ds4-1

Affected versions

1.*

1.19.2~ds1-1
1.19.2~ds1-2
1.19.2~ds1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/syncthing/syncthing

Affected ranges

Type
GIT
Repo
https://github.com/syncthing/syncthing
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
73c52eafb6566435dffd979c3c49562b6d5a4238

Affected versions

v0.*

v0.1
v0.10.0
v0.10.0-beta1
v0.10.1
v0.10.10
v0.10.11
v0.10.12
v0.10.13
v0.10.14
v0.10.15
v0.10.16
v0.10.17
v0.10.18
v0.10.19
v0.10.2
v0.10.20
v0.10.21
v0.10.22
v0.10.23
v0.10.24
v0.10.25
v0.10.26
v0.10.27
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.10.8
v0.10.9
v0.11.0
v0.11.0-beta0
v0.11.0-beta1
v0.11.0-beta2
v0.11.0-beta3
v0.11.0-beta4
v0.11.0-beta5
v0.11.0-beta6
v0.11.0-rc0
v0.11.0-rc1
v0.11.1
v0.11.10
v0.11.11
v0.11.12
v0.11.13
v0.11.14
v0.11.15
v0.11.16
v0.11.17
v0.11.18
v0.11.19
v0.11.2
v0.11.20
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.11.8
v0.11.9
v0.12.0
v0.12.0-beta0
v0.12.0-beta1
v0.12.0-beta2
v0.12.0-beta3
v0.12.0-beta4
v0.12.0-rc1
v0.12.0-rc2
v0.12.0-rc3
v0.12.0-rc4
v0.12.0-rc5
v0.12.0-rc6
v0.12.1
v0.12.10
v0.12.11
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.12.6
v0.12.7
v0.12.8
v0.12.9
v0.13.0
v0.13.0-beta.0
v0.13.0-beta.1
v0.13.0-beta.2
v0.13.0-beta.3
v0.13.0-beta.4
v0.13.1
v0.13.10
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.13.7
v0.13.8
v0.13.9
v0.14.0
v0.14.0-beta.0
v0.14.0-beta.1
v0.14.0-rc.1
v0.14.1
v0.14.10
v0.14.11
v0.14.12
v0.14.13
v0.14.14
v0.14.15
v0.14.16
v0.14.17
v0.14.18
v0.14.19
v0.14.2
v0.14.20
v0.14.21
v0.14.22
v0.14.22-rc.1
v0.14.23
v0.14.24
v0.14.24-rc.1
v0.14.25
v0.14.25-rc.1
v0.14.25-rc.2
v0.14.26
v0.14.26-rc.1
v0.14.27
v0.14.27-rc.1
v0.14.27-rc.2
v0.14.27-rc.3
v0.14.27-rc.4
v0.14.28
v0.14.28-rc.1
v0.14.28-rc.2
v0.14.28-rc.3
v0.14.29
v0.14.29-rc.1
v0.14.3
v0.14.30
v0.14.30-rc.1
v0.14.31
v0.14.31-rc.1
v0.14.32
v0.14.32-rc.1
v0.14.32-rc.2
v0.14.33
v0.14.33-rc.1
v0.14.34-rc.1
v0.14.35
v0.14.36
v0.14.37
v0.14.37-rc.1
v0.14.37-rc.2
v0.14.37-rc.3
v0.14.38
v0.14.38-rc.1
v0.14.39
v0.14.39-rc.1
v0.14.4
v0.14.40
v0.14.40-rc.1
v0.14.40-rc.2
v0.14.40-rc.3
v0.14.40-rc.4
v0.14.41
v0.14.41-rc.1
v0.14.41-rc.2
v0.14.41-rc.3
v0.14.41-rc.4
v0.14.41-rc.5
v0.14.41-rc.6
v0.14.42
v0.14.42-rc.1
v0.14.43
v0.14.43-rc.1
v0.14.44
v0.14.44-rc.1
v0.14.44-rc.2
v0.14.44-rc.3
v0.14.45
v0.14.45-rc.1
v0.14.45-rc.2
v0.14.45-rc.3
v0.14.46
v0.14.46-rc.1
v0.14.46-rc.2
v0.14.47
v0.14.47-rc.1
v0.14.47-rc.2
v0.14.47-rc.3
v0.14.47-rc.4
v0.14.48
v0.14.48-rc.1
v0.14.48-rc.2
v0.14.48-rc.3
v0.14.48-rc.4
v0.14.49
v0.14.49-rc.1
v0.14.49-rc.2
v0.14.49-rc.3
v0.14.49-rc.4
v0.14.5
v0.14.50
v0.14.50-rc.1
v0.14.50-rc.2
v0.14.50-rc.3
v0.14.51
v0.14.51-rc.1
v0.14.51-rc.2
v0.14.51-rc.3
v0.14.51-rc.4
v0.14.52
v0.14.52-rc.1
v0.14.52-rc.2
v0.14.52-rc.3
v0.14.53
v0.14.53-rc.1
v0.14.54
v0.14.55-rc.1
v0.14.55-rc.2
v0.14.6
v0.14.7
v0.14.8
v0.14.9
v0.2
v0.2.1
v0.2.2
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.8.1
v0.8.10
v0.8.11
v0.8.12
v0.8.13
v0.8.14
v0.8.15
v0.8.16
v0.8.17
v0.8.18
v0.8.19
v0.8.2
v0.8.20
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.0-beta1
v0.9.0-beta2
v0.9.0-beta3
v0.9.0-beta4
v0.9.0-beta5
v0.9.0-beta6
v0.9.0-beta7
v0.9.0-beta8
v0.9.0-beta9
v0.9.1
v0.9.10
v0.9.11
v0.9.13
v0.9.14
v0.9.15
v0.9.16
v0.9.17
v0.9.18
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9

v1.*

v1.0.0
v1.0.1
v1.0.1-rc.1
v1.0.1-rc.2
v1.1.0
v1.1.0-rc.1
v1.1.0-rc.2
v1.1.1
v1.1.1-rc.1
v1.1.1-rc.2
v1.1.2
v1.1.2-rc.1
v1.1.3
v1.1.4
v1.1.4-rc.1
v1.10.0
v1.10.0-rc.1
v1.10.0-rc.2
v1.10.0-rc.3
v1.11.0
v1.11.0-rc.1
v1.11.0-rc.2
v1.11.0-rc.3
v1.11.1
v1.12.0
v1.12.0-rc.1
v1.12.0-rc.2
v1.12.0-rc.3
v1.12.0-rc.4
v1.12.1
v1.12.1-rc.1
v1.13.0
v1.13.0-rc.1
v1.13.1
v1.14.0
v1.14.0-rc.1
v1.14.0-rc.2
v1.14.0-rc.3
v1.15.0
v1.15.0-rc.1
v1.15.0-rc.2
v1.15.0-rc.3
v1.15.0-rc.4
v1.15.0-rc.5
v1.15.0-rc.6
v1.15.1
v1.16.0
v1.16.0-rc.1
v1.16.0-rc.2
v1.16.0-rc.3
v1.16.1
v1.17.0
v1.17.0-rc.1
v1.17.0-rc.2
v1.17.0-rc.3
v1.17.0-rc.4
v1.18.0
v1.18.0-rc.1
v1.18.0-rc.2
v1.18.1
v1.18.1-rc.1
v1.18.1-rc.2
v1.18.1-rc.3
v1.18.2
v1.18.2-rc.1
v1.18.2-rc.2
v1.18.2-rc.3
v1.18.3
v1.18.3-rc.1
v1.18.3-rc.2
v1.18.4
v1.18.4-rc.1
v1.18.4-rc.2
v1.18.5
v1.18.5-rc.1
v1.18.5-rc.2
v1.18.6
v1.18.6-rc.1
v1.18.6-rc.2
v1.19.0
v1.19.0-rc.1
v1.19.0-rc.2
v1.19.1
v1.19.1-rc.1
v1.19.1-rc.2
v1.19.2
v1.19.2-rc.1
v1.19.2-rc.2
v1.2.0
v1.2.0-rc.1
v1.2.0-rc.2
v1.2.0-rc.3
v1.2.0-rc.4
v1.2.1
v1.2.1-rc.1
v1.2.1-rc.2
v1.2.1-rc.3
v1.2.1-rc.4
v1.2.1-rc.5
v1.2.2
v1.2.2-rc.1
v1.2.2-rc.2
v1.2.2-rc.3
v1.20.0
v1.20.0-rc.1
v1.20.0-rc.2
v1.20.0-rc.3
v1.20.1
v1.20.2
v1.20.2-rc.1
v1.20.2-rc.2
v1.20.2-rc.3
v1.20.3
v1.20.3-rc.1
v1.20.3-rc.2
v1.20.4
v1.20.4-rc.1
v1.20.4-rc.2
v1.21.0
v1.21.0-rc.1
v1.21.0-rc.2
v1.22.0
v1.22.0-rc.1
v1.22.0-rc.2
v1.22.1
v1.22.1-rc.1
v1.22.1-rc.2
v1.22.2
v1.22.2-rc.1
v1.22.2-rc.2
v1.22.2-rc.3
v1.22.3-rc.1
v1.22.3-rc.2
v1.23.0
v1.23.1
v1.23.1-rc.1
v1.23.2
v1.23.2-rc.1
v1.23.2-rc.2
v1.23.3
v1.23.3-rc.1
v1.23.3-rc.2
v1.23.4
v1.23.5-rc.1
v1.3.0
v1.3.0-rc.1
v1.3.0-rc.2
v1.3.1
v1.3.1-rc.1
v1.3.1-rc.2
v1.3.2
v1.3.2-rc.1
v1.3.2-rc.2
v1.3.2-rc.3
v1.3.3
v1.3.3-rc.1
v1.3.4
v1.3.4-rc.1
v1.4.0
v1.4.0-rc.1
v1.4.0-rc.10
v1.4.0-rc.10.1
v1.4.0-rc.11
v1.4.0-rc.2
v1.4.0-rc.3
v1.4.0-rc.4
v1.4.0-rc.5
v1.4.0-rc.6
v1.4.0-rc.7
v1.4.0-rc.8
v1.4.0-rc.9
v1.4.1
v1.4.1-rc.1
v1.4.1-rc.2
v1.4.1-rc.3
v1.4.2
v1.4.2-rc.1
v1.5.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.6.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.0-rc.4
v1.6.0-rc.5
v1.6.1
v1.7.0
v1.7.0-rc.1
v1.7.1
v1.8.0
v1.8.0-rc.1
v1.8.0-rc.2
v1.8.0-rc.3
v1.8.0-rc.4
v1.9.0
v1.9.0-rc.1
v1.9.0-rc.2
v1.9.0-rc.3
v1.9.0-rc.4
v1.9.0-rc.5