Inventree
CVE-2022-2134
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.
AnalysisAI
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. Affected products include: Inventree Project Inventree. Version information: prior to 0.8.0..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. Rated
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. Rated high seve
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3. Rated medium severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. Rated medium severity (CVSS
Authentication bypass in InvenTree open source inventory management system allows any authenticated user to generate API
Authenticated attackers with low-level privileges can exfiltrate sensitive database information from InvenTree open sour
InvenTree prior to version 1.2.3 allows authenticated staff users to inject malicious Jinja2 template code into batch co
InvenTree is an Open Source Inventory Management System. Rated medium severity (CVSS 5.4), this vulnerability is remotel
Server-side request forgery (SSRF) in InvenTree prior to versions 1.2.7 and 1.3.0 allows authenticated users to request
InvenTree versions prior to 1.2.6 contain a path traversal vulnerability in the report template engine that allows authe
InvenTree prior to versions 1.2.7 and 1.3.0 allows staff-level users to install arbitrary plugins via the API without re
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today