NagVis até 1.9.33 CoreLogonMultisite.php checkAuthCookie hash direitos alargados

Uma vulnerabilidade foi encontrada em NagVis até 1.9.33 e classificada como problemático. Afectado é a função checkAuthCookie do ficheiro share/server/core/classes/CoreLogonMultisite.php. A manipulação do argumento hash com uma entrada desconhecida leva a direitos alargados. A definição de CWE para a vulnerabilidade é CWE-704. O aconselhamento é partilhado para download em github.com. A vulnerabilidade é identificada como CVE-2022-3979. O ataque pode ser levado a cabo através da rede. Os detalhes técnicos estão disponíveis. Não há nenhuma exploração disponível. É declarado como não definido. Esperamos que o dia 0 tenha valido aproximadamente $0-$5k. A actualização para a versão 1.9.34 é capaz de abordar esta questão. A versão actualizada está pronta para ser descarregada em github.com. O nome do adesivo é 7574fd8a2903282c2e0d1feef5c4876763db21d5. O bugfix está pronto para download em github.com. Recomenda-se a actualização do componente afectado.

Campo17/12/2022 15h3017/12/2022 15h3624/10/2023 10h18
nameNagVisNagVisNagVis
version<=1.9.33<=1.9.33<=1.9.33
fileshare/server/core/classes/CoreLogonMultisite.phpshare/server/core/classes/CoreLogonMultisite.phpshare/server/core/classes/CoreLogonMultisite.php
functioncheckAuthCookiecheckAuthCookiecheckAuthCookie
argumenthashhashhash
cwe704 (direitos alargados)704 (direitos alargados)704 (direitos alargados)
risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acHHH
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier7574fd8a2903282c2e0d1feef5c4876763db21d57574fd8a2903282c2e0d1feef5c4876763db21d57574fd8a2903282c2e0d1feef5c4876763db21d5
urlhttps://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5
nameActualizaçãoActualizaçãoActualização
upgrade_version1.9.341.9.341.9.34
upgrade_urlhttps://github.com/NagVis/nagvis/releases/tag/nagvis-1.9.34https://github.com/NagVis/nagvis/releases/tag/nagvis-1.9.34https://github.com/NagVis/nagvis/releases/tag/nagvis-1.9.34
patch_name7574fd8a2903282c2e0d1feef5c4876763db21d57574fd8a2903282c2e0d1feef5c4876763db21d57574fd8a2903282c2e0d1feef5c4876763db21d5
patch_urlhttps://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5
cveCVE-2022-3979CVE-2022-3979CVE-2022-3979
responsibleVulDBVulDBVulDB
date1668294000 (13/11/2022)1668294000 (13/11/2022)1668294000 (13/11/2022)
cvss2_vuldb_avNNN
cvss2_vuldb_acHHH
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore5.15.15.1
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore5.65.65.6
cvss3_vuldb_tempscore5.45.45.4
cvss3_meta_basescore5.67.07.0
cvss3_meta_tempscore5.46.96.9
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1668294000 (13/11/2022)1668294000 (13/11/2022)1668294000 (13/11/2022)
cve_nvd_summaryA vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. Upgrading to version 1.9.34 is able to address this issue. The name of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. Upgrading to version 1.9.34 is able to address this issue. The name of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. Upgrading to version 1.9.34 is able to address this issue. The name of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
cvss3_nvd_avNN
cvss3_nvd_acLL
cvss3_nvd_prNN
cvss3_nvd_uiNN
cvss3_nvd_sUU
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cvss3_cna_avNN
cvss3_cna_acHH
cvss3_cna_prNN
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cve_cnaVulDBVulDB
cvss3_nvd_basescore9.89.8
cvss3_cna_basescore5.65.6
mischttps://www.sonarsource.com/blog/checkmk-rce-chain-2/

◂ VoltarVisão GeralPróximo ▸

Might our Artificial Intelligence support you?

Check our Alexa App!