PT-2022-27856 · Atos · Atos Unify Openscape 4000 Assistant+1

Published 2022-12-13 · Updated 2022-12-27 · CVE-2022-46404

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape 4000 Assistant versions 8 before R2.22.18 Atos Unify OpenScape 4000 Assistant versions 10 before 0.28.13 Atos Unify OpenScape 4000 Assistant versions 10 R1 before R1.34.4 Atos Unify OpenScape 4000 Manager versions 8 before R2.22.18 Atos Unify OpenScape 4000 Manager versions 10 before 0.28.13 Atos Unify OpenScape 4000 Manager versions 10 R1 before R1.34.4

Description A command injection issue has been identified that may allow an unauthenticated attacker to upload arbitrary files and achieve administrative access to the system.

Recommendations For Atos Unify OpenScape 4000 Assistant version 8, update to R2.22.18 or later. For Atos Unify OpenScape 4000 Assistant version 10, update to 0.28.13 or later. For Atos Unify OpenScape 4000 Assistant version 10 R1, update to R1.34.4 or later. For Atos Unify OpenScape 4000 Manager version 8, update to R2.22.18 or later. For Atos Unify OpenScape 4000 Manager version 10, update to 0.28.13 or later. For Atos Unify OpenScape 4000 Manager version 10 R1, update to R1.34.4 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-46404

Affected Products

Atos Unify Openscape 4000 Assistant

Atos Unify Openscape 4000 Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-46404 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46404 · Vendor Advisory
• https://networks.unify.com/security/advisories/OBSO-2211-02.pdf · Vendor Advisory
• https://heise.de/news/Kommunikationssoftware-Kritische-Sicherheitsluecke-in-Atos-Unify-OpenScape-4000-7358657.html · Note
• https://t.me/cibsecurity/54476 · Telegram Post