PT-2022-19916 · Unknown · Primeur Spazio

Alessandro Cudini + 4 · Published 2022-05-11 · Updated 2022-05-19 · CVE-2022-29932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PRIMEUR SPAZIO version 2.5.1.954

Description The issue allows an unauthenticated attacker to obtain sensitive data related to the content of transferred files via a crafted HTTP request.

Recommendations For version 2.5.1.954, consider restricting access to the HTTP Server in the File Transfer component until a patch is available. As a temporary workaround, avoid using the File Transfer feature to minimize the risk of exploitation.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-29932

Affected Products

Primeur Spazio

References · 5

• 🔥 https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.md · Exploit
• https://primeur.com/managed-file-transfer · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29932 · Security Note
• https://t.me/cibsecurity/42366 · Telegram Post