certfr_avis - certfr-2022-avi-371

CERTFR-2022-AVI-371

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Cisco Virtualized Infrastructure Manager (VIM) Software versions 4.x.x antérieures à 4.2.2
Cisco Umbrella Virtual Appliance Software Release versions 3.3.x antérieures à 3.3.2
Cisco TelePresence CE Software Release versions 9.x antérieures à 9.15.10.8
Cisco TelePresence CE Software Release versions 10.x antérieures à 10.11.2.2

Un correctif n'est pas prévu pour Cisco VIM versions antérieures à 3.6. L'éditeur préconise de mettre à jour à la version 4.2.2.
Un correctif n'est pas prévu pour Cisco Umbrella Virtual Appliance versions antérieures à 3.2. L'éditeur préconise de mettre à jour à la version 3.3.2.
Un correctif n'est pas prévu pour Cisco TelePresence CE versions antérieures à 9. L'éditeur préconise de mettre à jour vers une version corrigeant la vulnérabilité.

Cisco CX Cloud Agent Software versions antérieures à 2.1.0 (publication du correctif prévue pour le 20 avril 2022)
Cisco Automated Subsea Tuning versions antérieures à 2.1.0 (publication du correctif prévue pour le 31 mai 2022)
Cisco Crosswork Network Controller versions antérieures à 3.0.2 ou 2.0.2 (publication des correctifs prévue pour le 29 avril 2022)
Cisco Crosswork Optimization Engine versions antérieures à 3.1.1 ou 2.1.1 (publication des correctifs prévue pour le 1er mai 2022)
Cisco Crosswork Zero Touch Provisioning (ZTP) versions antérieures à 3.0.2 (publication du correctif prévue pour le 29 avril 2022)
Cisco Crosswork Zero Touch Provisioning (ZTP) versions antérieures à 2.0.2 (publication du correctif prévue pour le 20 avril 2022)
Cisco Evolved Programmable Network Manager versions antérieures à 6.0.1.1, 5.1.4.1 ou 5.0.2.3 (publication des correctifs prévue pour le 29 avril 2022)
Cisco Managed Services Accelerator (MSX) versions antérieures à 4.2.3 (publication du correctif prévue pour le 27 avril 2022)
Cisco Optical Network Planner versions antérieures à 5.0 (publication du correctif prévue pour le 30 août 2022)
Cisco WAN Automation Engine (WAE) Live versions antérieures à 7.5.2.1 (publication du correctif prévue pour le 19 avril 2022)
Cisco WAN Automation Engine (WAE) Live versions antérieures à 7.4.0.2 (publication du correctif prévue pour le 25 avril 2022)
Cisco WAN Automation Engine (WAE) Live versions antérieures à 7.3.0.3 (publication du correctif prévue pour le 29 avril 2022)
Cisco WAN Automation Engine (WAE) versions antérieures à 7.5.2.1 (publication du correctif prévue pour le 19 avril 2022)
Cisco WAN Automation Engine (WAE) versions antérieures à 7.4.0.2 (publication du correctif prévue pour le 25 avril 2022)
Cisco WAN Automation Engine (WAE) versions antérieures à 7.3.0.3 (publication du correctif prévue pour le 29 avril 2022)
Data Center Network Manager (DCNM) versions antérieures à 12.1.1 (publication du correctif prévue pour le 30 juin 2022)
Nexus Dashboard Fabric Controller (NDFC) versions antérieures à 12.1.1 (publication du correctif prévue pour le 30 juin 2022)
Cisco Optical Network Controller versions antérieures à 2.0 (publication du correctif prévue pour le 31 mai 2022)
Cisco Enterprise Chat and Email versions antérieures à 12.0 ou 12.5 (publication des correctifs prévue pour le 30 mai 2022)
Cisco Enterprise Chat and Email versions antérieures à 12.6 ES2 (publication des correctifs prévue pour le 15 mai 2022)
Cisco Meeting Server versions antérieures à 3.5.0 (publication des correctifs prévue pour le 30 avril 2022)
Cisco Meeting Server versions antérieures à 3.4.2 (publication des correctifs prévue pour le 31 mai 2022)
Cisco Meeting Server versions antérieures à 3.3.3 (publication des correctifs prévue pour le 17 juin 2022)
Cisco DNA Center toutes versions (pas d'annonce sur la disponibilité du correctif)
Cisco Software-Defined AVC (SD-AVC) toutes versions (pas d'annonce sur la disponibilité du correctif)

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco sa-ce-roomos-dos-c65x2Qf2 du 20 avril 2022	None	vendor-advisory
Bulletin de sécurité Cisco sa-java-spring-rce-Zx9GUc67 du 01 avril 2022	None	vendor-advisory
Bulletin de sécurité Cisco sa-uva-static-key-6RQTRs4c du 20 avril 2022	None	vendor-advisory
Bulletin de sécurité Cisco sa-vim-privesc-T2tsFUf du 20 avril 2022	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eCisco Virtualized Infrastructure Manager (VIM) Software versions 4.x.x ant\u00e9rieures \u00e0 4.2.2\u003c/li\u003e \u003cli\u003eCisco Umbrella Virtual Appliance Software Release versions 3.3.x ant\u00e9rieures \u00e0 3.3.2\u003c/li\u003e \u003cli\u003eCisco TelePresence CE Software Release versions 9.x ant\u00e9rieures \u00e0 9.15.10.8\u003c/li\u003e \u003cli\u003eCisco TelePresence CE Software Release versions 10.x ant\u00e9rieures \u00e0 10.11.2.2\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eUn correctif n\u0027est pas pr\u00e9vu pour Cisco VIM versions ant\u00e9rieures \u00e0 3.6. L\u0027\u00e9diteur pr\u00e9conise de mettre \u00e0 jour \u00e0 la version 4.2.2.\u003cbr /\u003e Un correctif n\u0027est pas pr\u00e9vu pour Cisco Umbrella Virtual Appliance versions ant\u00e9rieures \u00e0 3.2. L\u0027\u00e9diteur pr\u00e9conise de mettre \u00e0 jour \u00e0 la version 3.3.2.\u003cbr /\u003e Un correctif n\u0027est pas pr\u00e9vu pour Cisco TelePresence CE versions ant\u00e9rieures \u00e0 9. L\u0027\u00e9diteur pr\u00e9conise de mettre \u00e0 jour vers une version corrigeant la vuln\u00e9rabilit\u00e9.\u003c/p\u003e \u003cul\u003e \u003cli\u003eCisco CX Cloud Agent Software versions ant\u00e9rieures \u00e0 2.1.0 (publication du correctif pr\u00e9vue pour le 20 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Automated Subsea Tuning versions ant\u00e9rieures \u00e0 2.1.0 (publication du correctif pr\u00e9vue pour le 31 mai 2022)\u003c/li\u003e \u003cli\u003eCisco Crosswork Network Controller versions ant\u00e9rieures \u00e0 3.0.2 ou 2.0.2 (publication des correctifs pr\u00e9vue pour le 29 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Crosswork Optimization Engine versions ant\u00e9rieures \u00e0 3.1.1 ou 2.1.1 (publication des correctifs pr\u00e9vue pour le 1er mai 2022)\u003c/li\u003e \u003cli\u003eCisco Crosswork Zero Touch Provisioning (ZTP) versions ant\u00e9rieures \u00e0 3.0.2 (publication du correctif pr\u00e9vue pour le 29 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Crosswork Zero Touch Provisioning (ZTP) versions ant\u00e9rieures \u00e0 2.0.2 (publication du correctif pr\u00e9vue pour le 20 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Evolved Programmable Network Manager versions ant\u00e9rieures \u00e0 6.0.1.1, 5.1.4.1 ou 5.0.2.3 (publication des correctifs pr\u00e9vue pour le 29 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Managed Services Accelerator (MSX) versions ant\u00e9rieures \u00e0 4.2.3 (publication du correctif pr\u00e9vue pour le 27 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Optical Network Planner versions ant\u00e9rieures \u00e0 5.0 (publication du correctif pr\u00e9vue pour le 30 ao\u00fbt 2022)\u003c/li\u003e \u003cli\u003eCisco WAN Automation Engine (WAE) Live versions ant\u00e9rieures \u00e0 7.5.2.1 (publication du correctif pr\u00e9vue pour le 19 avril 2022)\u003c/li\u003e \u003cli\u003eCisco WAN Automation Engine (WAE) Live versions ant\u00e9rieures \u00e0 7.4.0.2 (publication du correctif pr\u00e9vue pour le 25 avril 2022)\u003c/li\u003e \u003cli\u003eCisco WAN Automation Engine (WAE) Live versions ant\u00e9rieures \u00e0 7.3.0.3 (publication du correctif pr\u00e9vue pour le 29 avril 2022)\u003c/li\u003e \u003cli\u003eCisco WAN Automation Engine (WAE) versions ant\u00e9rieures \u00e0 7.5.2.1 (publication du correctif pr\u00e9vue pour le 19 avril 2022)\u003c/li\u003e \u003cli\u003eCisco WAN Automation Engine (WAE) versions ant\u00e9rieures \u00e0 7.4.0.2 (publication du correctif pr\u00e9vue pour le 25 avril 2022)\u003c/li\u003e \u003cli\u003eCisco WAN Automation Engine (WAE) versions ant\u00e9rieures \u00e0 7.3.0.3 (publication du correctif pr\u00e9vue pour le 29 avril 2022)\u003c/li\u003e \u003cli\u003eData Center Network Manager (DCNM) versions ant\u00e9rieures \u00e0 12.1.1 (publication du correctif pr\u00e9vue pour le 30 juin 2022)\u003c/li\u003e \u003cli\u003eNexus Dashboard Fabric Controller (NDFC) versions ant\u00e9rieures \u00e0 12.1.1 (publication du correctif pr\u00e9vue pour le 30 juin 2022)\u003c/li\u003e \u003cli\u003eCisco Optical Network Controller versions ant\u00e9rieures \u00e0 2.0 (publication du correctif pr\u00e9vue pour le 31 mai 2022)\u003c/li\u003e \u003cli\u003eCisco Enterprise Chat and Email versions ant\u00e9rieures \u00e0 12.0 ou 12.5 (publication des correctifs pr\u00e9vue pour le 30 mai 2022)\u003c/li\u003e \u003cli\u003eCisco Enterprise Chat and Email versions ant\u00e9rieures \u00e0 12.6 ES2 (publication des correctifs pr\u00e9vue pour le 15 mai 2022)\u003c/li\u003e \u003cli\u003eCisco Meeting Server versions ant\u00e9rieures \u00e0 3.5.0 (publication des correctifs pr\u00e9vue pour le 30 avril 2022)\u003c/li\u003e \u003cli\u003eCisco Meeting Server versions ant\u00e9rieures \u00e0 3.4.2 (publication des correctifs pr\u00e9vue pour le 31 mai 2022)\u003c/li\u003e \u003cli\u003eCisco Meeting Server versions ant\u00e9rieures \u00e0 3.3.3 (publication des correctifs pr\u00e9vue pour le 17 juin 2022)\u003c/li\u003e \u003cli\u003eCisco DNA Center toutes versions (pas d\u0027annonce sur la disponibilit\u00e9 du correctif)\u003c/li\u003e \u003cli\u003eCisco Software-Defined AVC (SD-AVC) toutes versions (pas d\u0027annonce sur la disponibilit\u00e9 du correctif)\u003c/li\u003e \u003c/ul\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-22965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
    },
    {
      "name": "CVE-2022-20773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20773"
    },
    {
      "name": "CVE-2022-20732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20732"
    },
    {
      "name": "CVE-2022-20783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20783"
    }
  ],
  "initial_release_date": "2022-04-21T00:00:00",
  "last_revision_date": "2022-04-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-371",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-04-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco sa-ce-roomos-dos-c65x2Qf2 du 20 avril 2022",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ce-roomos-dos-c65x2Qf2"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco sa-java-spring-rce-Zx9GUc67 du 01 avril 2022",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco sa-uva-static-key-6RQTRs4c du 20 avril 2022",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco sa-vim-privesc-T2tsFUf du 20 avril 2022",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vim-privesc-T2tsFUf"
    }
  ]
}

CVE-2022-20773 (GCVE-0-2022-20773)

Vulnerability from cvelistv5

Published

2022-04-21 18:55

Modified

2024-11-06 16:21

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-321

Summary

A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a man-in-the-middle attack on an SSH connection to the Umbrella VA. A successful exploit could allow the attacker to learn the administrator credentials, change configurations, or reload the VA. Note: SSH is not enabled by default on the Umbrella VA.

References

URL

Tags

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c

vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Umbrella Insights Virtual Appliance	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:24:49.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20220420 Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-20773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:00:11.220768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:21:29.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Umbrella Insights Virtual Appliance",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2022-04-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a man-in-the-middle attack on an SSH connection to the Umbrella VA. A successful exploit could allow the attacker to learn the administrator credentials, change configurations, or reload the VA. Note: SSH is not enabled by default on the Umbrella VA."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-21T18:55:16",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20220420 Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c"
        }
      ],
      "source": {
        "advisory": "cisco-sa-uva-static-key-6RQTRs4c",
        "defect": [
          [
            "CSCwa11399"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2022-04-20T16:00:00",
          "ID": "CVE-2022-20773",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Umbrella Insights Virtual Appliance",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a man-in-the-middle attack on an SSH connection to the Umbrella VA. A successful exploit could allow the attacker to learn the administrator credentials, change configurations, or reload the VA. Note: SSH is not enabled by default on the Umbrella VA."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "7.5",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-321"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20220420 Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-uva-static-key-6RQTRs4c",
          "defect": [
            [
              "CSCwa11399"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2022-20773",
    "datePublished": "2022-04-21T18:55:16.531148Z",
    "dateReserved": "2021-11-02T00:00:00",
    "dateUpdated": "2024-11-06T16:21:29.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-22965 (GCVE-0-2022-22965)

Vulnerability from cvelistv5

Published

2022-04-01 22:17

Modified

2025-10-21 23:15

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Summary

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

References

URL

Tags

	https://tanzu.vmware.com/security/cve-2022-22965	x_refsource_MISC
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67	vendor-advisory, x_refsource_CISCO
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC
	http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Spring Framework	Version: Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:28:42.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/970766"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2022-22965"
          },
          {
            "name": "20220401 Vulnerability in Spring Framework Affecting Cisco Products: March 2022",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-22965",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T17:52:10.886552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-04-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:15:42.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-04-04T00:00:00+00:00",
            "value": "CVE-2022-22965 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Framework",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:46:59.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2022-22965"
        },
        {
          "name": "20220401 Vulnerability in Spring Framework Affecting Cisco Products: March 2022",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2022-22965",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2022-22965",
              "refsource": "MISC",
              "url": "https://tanzu.vmware.com/security/cve-2022-22965"
            },
            {
              "name": "20220401 Vulnerability in Spring Framework Affecting Cisco Products: March 2022",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005"
            },
            {
              "name": "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-22965",
    "datePublished": "2022-04-01T22:17:30.000Z",
    "dateReserved": "2022-01-10T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:15:42.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-20783 (GCVE-0-2022-20783)

Vulnerability from cvelistv5

Published

2022-04-21 18:50

Modified

2024-11-06 16:23

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-1287

Summary

A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted H.323 traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to either reboot normally or reboot into maintenance mode, which could result in a DoS condition on the device.

References

URL

Tags

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ce-roomos-dos-c65x2Qf2

vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco RoomOS Software	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:24:49.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20220420 Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ce-roomos-dos-c65x2Qf2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-20783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:01:41.287186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:23:26.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco RoomOS Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2022-04-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted H.323 traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to either reboot normally or reboot into maintenance mode, which could result in a DoS condition on the device."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1287",
              "description": "CWE-1287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-21T18:50:16",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20220420 Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ce-roomos-dos-c65x2Qf2"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ce-roomos-dos-c65x2Qf2",
        "defect": [
          [
            "CSCvz55702"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2022-04-20T16:00:00",
          "ID": "CVE-2022-20783",
          "STATE": "PUBLIC",
          "TITLE": "Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco RoomOS Software",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted H.323 traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to either reboot normally or reboot into maintenance mode, which could result in a DoS condition on the device."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "7.5",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20220420 Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ce-roomos-dos-c65x2Qf2"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-ce-roomos-dos-c65x2Qf2",
          "defect": [
            [
              "CSCvz55702"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2022-20783",
    "datePublished": "2022-04-21T18:50:16.611172Z",
    "dateReserved": "2021-11-02T00:00:00",
    "dateUpdated": "2024-11-06T16:23:26.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-20732 (GCVE-0-2022-20732)

Vulnerability from cvelistv5

Published

2022-04-21 18:55

Modified

2024-11-06 16:21

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-284

Summary

A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to improper access permissions for certain configuration files. An attacker with low-privileged credentials could exploit this vulnerability by accessing an affected device and reading the affected configuration files. A successful exploit could allow the attacker to obtain internal database credentials, which the attacker could use to view and modify the contents of the database. The attacker could use this access to the database to elevate privileges on the affected device.

References

URL

Tags

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vim-privesc-T2tsFUf

vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Virtualized Infrastructure Manager	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:24:49.668Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20220420 Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vim-privesc-T2tsFUf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-20732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:00:12.300343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:21:38.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Virtualized Infrastructure Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2022-04-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to improper access permissions for certain configuration files. An attacker with low-privileged credentials could exploit this vulnerability by accessing an affected device and reading the affected configuration files. A successful exploit could allow the attacker to obtain internal database credentials, which the attacker could use to view and modify the contents of the database. The attacker could use this access to the database to elevate privileges on the affected device."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-21T18:55:10",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20220420 Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vim-privesc-T2tsFUf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-vim-privesc-T2tsFUf",
        "defect": [
          [
            "CSCvz96773"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2022-04-20T16:00:00",
          "ID": "CVE-2022-20732",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Virtualized Infrastructure Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to improper access permissions for certain configuration files. An attacker with low-privileged credentials could exploit this vulnerability by accessing an affected device and reading the affected configuration files. A successful exploit could allow the attacker to obtain internal database credentials, which the attacker could use to view and modify the contents of the database. The attacker could use this access to the database to elevate privileges on the affected device."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "7.8",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20220420 Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vim-privesc-T2tsFUf"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-vim-privesc-T2tsFUf",
          "defect": [
            [
              "CSCvz96773"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2022-20732",
    "datePublished": "2022-04-21T18:55:10.749228Z",
    "dateReserved": "2021-11-02T00:00:00",
    "dateUpdated": "2024-11-06T16:21:38.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2022-AVI-371

Vulnerability from certfr_avis

Solution

CVE-2022-20773 (GCVE-0-2022-20773)

Vulnerability from cvelistv5

CVE-2022-22965 (GCVE-0-2022-22965)

Vulnerability from cvelistv5

CVE-2022-20783 (GCVE-0-2022-20783)

Vulnerability from cvelistv5

CVE-2022-20732 (GCVE-0-2022-20732)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature