PT-2022-19468 · Unknown · Regionprotect

Nhanaz + 1 · Published 2022-05-21 · Updated 2022-06-07 · CVE-2022-29215

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RegionProtect versions prior to 1.1.0

Description The issue is related to a YAML injection vulnerability in RegionProtect, a plugin for managing events in certain regions. This vulnerability can cause an instant server crash if the passed arguments are not matched.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 to resolve the issue. As a temporary workaround, restrict operator permissions to untrusted people and avoid entering arguments likely to cause a crash.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2022-29215

GHSA-7GR2-W2R3-R9VF

Affected Products

Regionprotect

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29215.json · Exploit
• https://github.com/kaidomc-pm-pl/RegionProtect/commit/0060d421358ab59acb6a168eab0d11c43d2d105d · Patch
• https://github.com/kaidomc-pm-pl/RegionProtect/security/advisories/GHSA-7gr2-w2r3-r9vf · Patch
• https://osv.dev/vulnerability/CVE-2022-29215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29215 · Security Note
• https://t.me/cvenotify/30535 · Telegram Post