PT-2023-15807 · Unknown · Control De Ciber

Sergio Apellániz · Published 2023-09-12 · Updated 2023-09-15 · CVE-2022-48474

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Control de Ciber version 1.650

Description The issue is a Denial of Service condition that affects Control de Ciber through the version function. Sending a malicious request could cause the server to check if an unrecognized component is up to date, resulting in a memory failure error that shuts down the process.

Recommendations For Control de Ciber version 1.650, as a temporary workaround, consider disabling the version function until a patch is available. Restrict access to the version function to minimize the risk of exploitation. Avoid sending malicious requests to the server to prevent the Denial of Service condition. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-48474

Affected Products

Control De Ciber

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-48474 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48474 · Vendor Advisory
• https://t.me/cibsecurity/70245 · Telegram Post
• https://t.me/cvenotify/58036 · Telegram Post
• https://twitter.com/CVEnew/status/1701500662683742615 · Twitter Post
• https://twitter.com/cracbot/status/1701838172899115092 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber · Note