PT-2023-15027 · Stormshield · Stormshield Ssl Vpn Client

Daniel Kalinowski · Publicado 2023-08-05 · Atualizado 2023-08-09 · CVE-2022-46782

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stormshield SSL VPN Client versions prior to 3.2.0

Description A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenVPN instance until a patch is available.

Correção

Identificadores relacionados

CVE-2022-46782

Produtos afetados

Stormshield Ssl Vpn Client

Referências · 4

• https://advisories.stormshield.eu/2022-028 · Aviso do Fabricante
• https://t.me/cvenotify/56101 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-46782 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-46782 · Aviso do Fabricante