PT-2022-27060 · Unknown · Backclick Professional

Moritz Bechler · Published 2022-11-16 · Updated 2022-11-21 · CVE-2022-43999

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BACKCLICK Professional version 5.9.63

Description An issue was discovered due to exposed CORBA management services, allowing arbitrary system commands to be executed on the server.

Recommendations For BACKCLICK Professional version 5.9.63, consider restricting access to the CORBA management services as a temporary workaround until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-43999

Affected Products

Backclick Professional

References · 4

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-034.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-43999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43999 · Security Note
• https://syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 · Note