PT-2022-25670 · Mitre · Mitre Caldera

L50 · Published 2022-10-17 · Updated 2022-10-19 · CVE-2022-41139

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MITRE CALDERA version 4.1.0

Description The issue allows stored XSS via the app.contact.gist field, also known as the gist contact configuration field, leading to the execution of arbitrary commands on agents.

Recommendations For MITRE CALDERA version 4.1.0, consider disabling the app.contact.gist field until a patch is available to prevent the execution of arbitrary commands on agents. Restrict access to this field to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41139

GHSA-7344-4PG9-QF45

Affected Products

Mitre Caldera

References · 4

• 🔥 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-7344-4pg9-qf45 · Exploit
• https://osv.dev/vulnerability/CVE-2022-41139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41139 · Security Note
• https://t.me/cibsecurity/51637 · Telegram Post