PT-2023-15530 · Secvisogram · Csaf-Validator-Service

Damian Pfammatter · Publicado 2023-03-27 · Atualizado 2024-02-15 · CVE-2022-47925

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Secvisogram csaf-validator-service versions prior to 0.1.0

Description The issue is related to insufficient input validation of requests by an unauthenticated remote user, which might lead to a partial Denial of Service (DoS) of the service. Specifically, the validate JSON endpoint processes tests with unexpected names. This affects only the request of the attacker.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the validate JSON endpoint to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2022-47925

Produtos afetados

Csaf-Validator-Service

Referências · 4

• https://t.me/cibsecurity/60784 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-47925 · Nota de Segurança
• https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.json · Nota
• https://osv.dev/vulnerability/CVE-2022-47925 · Aviso do Fabricante