PT-2022-21197 · Opswat · Opswat Metadefender Icap+2

Published 2022-06-09 · Updated 2023-03-28 · CVE-2022-32272

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPSWAT MetaDefender Core versions prior to 5.1.2 OPSWAT MetaDefender ICAP versions prior to 4.12.1 OPSWAT MetaDefender Email Gateway Security versions prior to 5.6.1

Description The issue is related to incorrect access control, which can result in privilege escalation.

Recommendations For OPSWAT MetaDefender Core versions prior to 5.1.2, update to version 5.1.2 or later. For OPSWAT MetaDefender ICAP versions prior to 4.12.1, update to version 4.12.1 or later. For OPSWAT MetaDefender Email Gateway Security versions prior to 5.6.1, update to version 5.6.1 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-32272

Affected Products

Opswat Metadefender Core

Opswat Metadefender Email Gateway Security

Opswat Metadefender Icap

References · 11

• 🔥 https://exploit-db.com/exploits/51113 · Exploit
• https://osv.dev/vulnerability/CVE-2022-32272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32272 · Security Note
• https://docs.opswat.com/mdcore/release-notes · Vendor Advisory
• http://packetstormsecurity.com/files/171549/OPSWAT-Metadefender-Core-4.21.1-Privilege-Escalation.html · Note
• https://t.me/cibsecurity/44104 · Telegram Post
• https://docs.opswat.com/mdicap/release-notes · Note
• https://docs.opswat.com/mdemail/release-notes/version-5-6-1 · Note
• https://opswat.com · Note
• https://docs.opswat.com/mdemail/release-notes · Note
• https://docs.opswat.com/mdicap/release-notes/version-4-12-1 · Note