PT-2022-26108 · Opticam · Optica

Ohler55 · Published 2022-11-23 · Updated 2022-11-30 · CVE-2022-41875

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Optica versions prior to 0.10.2

Description A remote code execution issue in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. This can lead to remote code execution on the attacked system running Optica.

Recommendations For versions prior to 0.10.2, update to version 0.10.2 or later, where the call to the function oj.load was changed to oj.safe load to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-41875

GHSA-CF87-4H6X-PHH6

Affected Products

Optica

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41875.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41875 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41875 · Vendor Advisory
• https://rubydoc.info/gems/oj/3.0.2/Oj.safe_load · Vendor Advisory
• https://github.com/ohler55/oj/blob/develop/pages/Security.md · Note
• https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6 · Note