PT-2022-27265 · Unknown · Diagnosis Controller

Messy God · Published 2022-12-30 · Updated 2023-01-09 · CVE-2022-44621

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Diagnosis Controller (affected versions not specified)

Description The issue concerns a lack of parameter validation in the Diagnosis Controller, which can be exploited through command injection via HTTP Request. This allows an attacker to inject malicious commands, potentially leading to unauthorized access or control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-44621

GHSA-W9RV-XMF7-X3GH

Affected Products

Diagnosis Controller

References · 11

• https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44621 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44621 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w9rv-xmf7-x3gh · Vendor Advisory
• https://github.com/apache/kylin · Note
• https://github.com/apache/kylin/pull/2011 · Note
• https://github.com/apache/kylin/pull/2011/commits/418a63c61379d429312972fc94b87994e06b664f · Note
• https://github.com/apache/kylin/commit/fd2977e21c51f1afed668f2d9713cf562f2dc42d · Note
• https://t.me/cvenotify/41003 · Telegram Post
• https://t.me/pentestingnews/31782 · Telegram Post
• https://t.me/cibsecurity/55554 · Telegram Post