What’s Vulnerable › Vulnerabilities

CVE-2022-29773

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-03 · updated 2026-06-17

Description

An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.

Affected products

• Aleksis: before 2.8.2 — fixed in 2.8.2

How to fix

Upgrade to a fixed version: Aleksis 2.8.2. Check the vendor advisory for mitigations.

References

• https://aleksis.org/2022-05-04_advisory.html
• https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/688
• https://aleksis.org/2022-05-04_advisory.html
• https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/688

Get alerted when CVE-2022-29773 or the next vulnerability affects your stack