jvndb - jvndb-2022-002780

jvndb-2022-002780

Vulnerability from jvndb

Published

2022-12-20 12:12

Modified

2022-12-20 12:12

Severity ?

9.1 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

Command injection vulnerability in SHARP Multifunctional Products (MFP)

Details

SHARP Multifunctional Products (MFP) contain a command injection vulnerability (CWE-77, CVE-2022-45796). The OS layer is affected beyond the web application component, however treating the web application component as separate from the OS layer, 'Scope' is analyzed as 'S:C'. Sharp reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.

References

Type

URL

	JVN	http://jvn.jp/en/vu/JVNVU96195138/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2022-45796
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-45796
	Related document	https://zuso.ai/Advisory/ZA-2022-01.html
	Command Injection(CWE-77)	https://cwe.mitre.org/data/definitions/77.html

Impacted products

Vendor

Product

Sharp Corporation

(Multiple Products)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-002780.html",
  "dc:date": "2022-12-20T12:12+09:00",
  "dcterms:issued": "2022-12-20T12:12+09:00",
  "dcterms:modified": "2022-12-20T12:12+09:00",
  "description": "SHARP Multifunctional Products (MFP) contain a command injection vulnerability (CWE-77, CVE-2022-45796).\r\n\r\nThe OS layer is affected beyond the web application component, however treating the web application component as separate from the OS layer, \u0027Scope\u0027 is analyzed as \u0027S:C\u0027.\r\n\r\nSharp reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-002780.html",
  "sec:cpe": {
    "#text": "cpe:/a:sharp:multiple_product",
    "@product": "(Multiple Products)",
    "@vendor": "Sharp Corporation",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "9.1",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2022-002780",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/vu/JVNVU96195138/index.html",
      "@id": "JVNVU#96195138",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-45796",
      "@id": "CVE-2022-45796",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-45796",
      "@id": "CVE-2022-45796",
      "@source": "NVD"
    },
    {
      "#text": "https://zuso.ai/Advisory/ZA-2022-01.html",
      "@id": "SHARP Multifunction Printer - Command Injection",
      "@source": "Related document"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/77.html",
      "@id": "CWE-77",
      "@title": "Command Injection(CWE-77)"
    }
  ],
  "title": "Command injection vulnerability in SHARP Multifunctional Products (MFP)"
}

CVE-2022-45796 (GCVE-0-2022-45796)

Vulnerability from cvelistv5

Published

2022-12-16 00:00

Modified

2025-04-17 16:02

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Summary

Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors.

References

URL

Tags

	https://global.sharp/products/copier/info/info_security_2022-11.html
	https://jvn.jp/en/vu/JVNVU96195138/index.html
	https://zuso.ai/advisory/ZA-2022-01.html
	http://seclists.org/fulldisclosure/2024/Jul/0	mailing-list

Impacted products

	Vendor	Product	Version
	SHARP	SHARP multifunction printers	Version: Digital Full-color Multifunctional System < Version: Digital Multifunctional System (Monochrome) <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:17:04.074Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://global.sharp/products/copier/info/info_security_2022-11.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU96195138/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://zuso.ai/advisory/ZA-2022-01.html"
          },
          {
            "name": "20240703 17 vulnerabilities in Sharp Multi-Function Printers",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-45796",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T16:02:30.391892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T16:02:57.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SHARP multifunction printers",
          "vendor": "SHARP",
          "versions": [
            {
              "lessThanOrEqual": "202",
              "status": "affected",
              "version": "Digital Full-color Multifunctional System",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "200",
              "status": "affected",
              "version": "Digital Multifunctional System (Monochrome)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)\u0027s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-04T05:06:11.660Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "url": "https://global.sharp/products/copier/info/info_security_2022-11.html"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU96195138/index.html"
        },
        {
          "url": "https://zuso.ai/advisory/ZA-2022-01.html"
        },
        {
          "name": "20240703 17 vulnerabilities in Sharp Multi-Function Printers",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/Jul/0"
        }
      ],
      "source": {
        "defect": [
          "ZA-2022-01"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SHARP Multifunction Printer - Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2022-45796",
    "datePublished": "2022-12-16T00:00:00.000Z",
    "dateReserved": "2022-11-22T00:00:00.000Z",
    "dateUpdated": "2025-04-17T16:02:57.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2022-002780

Vulnerability from jvndb

CVE-2022-45796 (GCVE-0-2022-45796)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature