PT-2022-13825 · Cnmaestro · Cnmaestro

Noam Moshe · Published 2022-05-17 · Updated 2022-06-06 · CVE-2022-1359

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions On-Premise cnMaestro (affected versions not specified)

Description The issue allows for an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specific route. If an attacker supplies path traversal characters (../) as part of a filename, the server will save the file where the attacker chooses, potentially allowing an attacker to write any data to any file in the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

OS Command Injection

Weakness Enumeration

CWE-22

CWE-78

Related Identifiers

CVE-2022-1359

Affected Products

Cnmaestro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-1359 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1359 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-04 · Note
• https://t.me/cibsecurity/42871 · Telegram Post