PT-2022-24252 · F Secure · F-Secure Policy Manager+1

Kevin Joensen · Published 2022-11-17 · Updated 2022-11-22 · CVE-2022-38165

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F-Secure Policy Manager versions prior to 2022-08-10 WithSecure versions prior to 2022-08-10

Description The issue allows unauthenticated users to perform an arbitrary file write, enabling them to write files with arbitrary contents in various locations on the server. This can lead to a denial of service.

Recommendations For F-Secure Policy Manager versions prior to 2022-08-10, update to a version released after 2022-08-10 to resolve the issue. For WithSecure versions prior to 2022-08-10, update to a version released after 2022-08-10 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-38165

Affected Products

F-Secure Policy Manager

Withsecure

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-38165 · Security Note
• https://withsecure.com/en/support/security-advisories/cve-2022-38165 · Vendor Advisory
• https://t.me/cibsecurity/53118 · Telegram Post