PT-2022-18678 · Unknown · Eve-Ng Community+1

Cas Van Cooten + 1 · Published 2022-05-04 · Updated 2022-05-11 · CVE-2022-27903

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eve-NG Professional versions 4.0.1-65 and earlier Eve-NG Community versions 2.0.3-112 and earlier

Description The issue allows a remote authenticated attacker to execute commands as root by editing virtualization command parameters of imported UNL files. This is due to an OS Command Injection vulnerability in the configuration parser.

Recommendations For Eve-NG Professional versions 4.0.1-65 and earlier, update to a version later than 4.0.1-65 to resolve the issue. For Eve-NG Community versions 2.0.3-112 and earlier, update to a version later than 2.0.3-112 to resolve the issue. As a temporary workaround, consider restricting access to editing virtualization command parameters of imported UNL files until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-27903

Affected Products

Eve-Ng Community

Eve-Ng Professional

References · 5

• https://osv.dev/vulnerability/CVE-2022-27903 · Vendor Advisory
• https://eve-ng.net · Vendor Advisory
• https://eve-ng.net/index.php/documentation/release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27903 · Security Note
• https://t.me/cibsecurity/41909 · Telegram Post