CVEDB API

The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 62.3%

CVSS Severity

CVSS v3 Score 9.3

CVSS v2 Score 6.4

References

Products affected by CVE-2022-31558

Shiva-Server Project » Shiva-Server » Version: N/A

cpe:2.3:a:shiva-server_project:shiva-server:-
Shiva-Server Project » Shiva-Server » Version: 0.10.0

cpe:2.3:a:shiva-server_project:shiva-server:0.10.0
Shiva-Server Project » Shiva-Server » Version: 0.7.0

cpe:2.3:a:shiva-server_project:shiva-server:0.7.0
Shiva-Server Project » Shiva-Server » Version: 0.8.0

cpe:2.3:a:shiva-server_project:shiva-server:0.8.0
Shiva-Server Project » Shiva-Server » Version: 0.9.0

cpe:2.3:a:shiva-server_project:shiva-server:0.9.0