CVE-2022-1399 - Remote code execution in scheduled tasks component

Back Back to CVE browser

CRITICAL

Remote code execution in scheduled tasks component

Published Aug 16, 2022

9.1

CRITICAL

CVSS 3.1

EPSS 0.91%

Description

An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.

Affected products

Vendor Device42 Product CMDB Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <18.01.00

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Device42

CMDB

n/a

Version	Status	Constraints
unspecified	affected	<18.01.00

Remediation

Vendor solution

An update to version 18.01.00 fixes the issue

Weaknesses (1)

CWE-88

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24715
Advisory
https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24715		Advisory
https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/		x_refsource_MISCThird Party Advisory