Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 (Nozomi Networks Guardian)

CVE-2022-0550
HIGH 8.6

En bref

Source
NVD
EPSS
EPSS 0.90 % · centile 60 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Nozomi
Statut NVD
Modified

Rechercher sur…

Description

Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.

Faiblesses (CWE)

  • CWE-20 — Validation d'entrée incorrecte

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNozomi
CVSS 4.0HIGH 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NNozomi
CVSS 4.0HIGH 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · prodsec@nozominetworks.com (Secondary)
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · prodsec@nozominetworks.com (Secondary)
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 6.5AV:N/AC:L/Au:S/C:P/I:P/A:PNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Nozomi Networks · Guardianaffected unspecified < 22.0.0
Nozomi Networks · CMCaffected unspecified < 22.0.0

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD