2 lines
4.6 KiB
JSON
2 lines
4.6 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://crates.io","defaultStatus":"unaffected","modules":["sparse index"],"packageName":"cargo","product":"Cargo","repo":"https://github.com/rust-lang/cargo","vendor":"Rust","versions":[{"lessThan":"1.96.0","status":"affected","version":"1.68.0","versionType":"semver"}]}],"source":"986d4109-89ea-491f-99fd-a8e4803919bd"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*","matchCriteriaId":"143A0C07-6AA8-4711-A789-152DA178214C","versionEndExcluding":"1.96.0","versionStartIncluding":"1.68.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack."},{"lang":"es","value":"Cargo entre 1.68 y 1.96 normalizó incorrectamente las URL de registros de terceros utilizando el protocolo de índice disperso. Si un proveedor de alojamiento permitía que se alojaran múltiples registros con nombres arbitrarios dentro del mismo dominio, un atacante capaz de publicar crates en un registro podría obtener las credenciales de otros usuarios del mismo registro. La gravedad de la vulnerabilidad es baja, debido a los requisitos extremadamente específicos necesarios para lograr el ataque."}],"id":"CVE-2026-5222","lastModified":"2026-07-23T17:10:00.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"986d4109-89ea-491f-99fd-a8e4803919bd","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-26T14:36:59.303136Z","version":"2.0.3"}}]},"published":"2026-05-25T10:16:15.273","references":[{"source":"986d4109-89ea-491f-99fd-a8e4803919bd","tags":["Vendor Advisory"],"url":"https://blog.rust-lang.org/2026/05/25/cve-2026-5222/"},{"source":"986d4109-89ea-491f-99fd-a8e4803919bd","tags":["Issue Tracking","Patch"],"url":"https://github.com/rust-lang/cargo/pull/17031"},{"source":"986d4109-89ea-491f-99fd-a8e4803919bd","tags":["Mailing List","Third Party Advisory"],"url":"https://groups.google.com/g/rustlang-security-announcements/c/SfUxOiIdY5s"}],"sourceIdentifier":"986d4109-89ea-491f-99fd-a8e4803919bd","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-647"}],"source":"986d4109-89ea-491f-99fd-a8e4803919bd","type":"Secondary"}]}
|