VulnerabilityModified
CVE-2022-44268
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure.
MEDIUM 6.5EPSS 89.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 89.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 89.85% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- imagemagick/imagemagick
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/171727/ImageMagick-7.1.0-48-Arbitrary-File-Read.html
- https://imagemagick.org/Product
- https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AINSUL2QBKETGYRPA7XSCMJWLUB44M6S/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZLLS37P67CMBRML6OCG42GPCKGRCJNV/
- https://www.debian.org/security/2023/dsa-5347
- https://www.metabaseq.com/imagemagick-zero-days/Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/171727/ImageMagick-7.1.0-48-Arbitrary-File-Read.html
- https://imagemagick.org/Product
- https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AINSUL2QBKETGYRPA7XSCMJWLUB44M6S/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZLLS37P67CMBRML6OCG42GPCKGRCJNV/
- https://www.debian.org/security/2023/dsa-5347
- https://www.metabaseq.com/imagemagick-zero-days/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.