Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2022-44268 — Sensitive Information Exposure in Imagemagick
Severity
6.5MEDIUMNVD
EPSS
88.5%
top 0.49%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedFeb 6
Latest updateApr 17
Description
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
2💥Exploits & PoCs
1🔍Detection Rules
1Suricata▶
ET EXPLOIT Possible ImageMagick (7.1.0-49) Arbitrary Remote Leak PNG Upload Attempt (CVE-2022-44268)↗2023-02-05
📋Vendor Advisories
5Debian▶
CVE-2022-44268: imagemagick - ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a P...↗2022