Lucene search

[email protected]CVE-2022-3090

HistoryNov 17, 2022 - 10:15 p.m.

CVE-2022-3090

2022-11-1722:15:10

CWE-22

[email protected]

web.nvd.nist.gov

red lion controls

crimson 3.0

crimson 3.1

crimson 3.2

cve-2022-3090

path traversal

user credentials

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.6%

JSON

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user’s password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.

Affected configurations

NVD

Node

redlioncrimsonRange<3.0

redlioncrimsonMatch3.0-

redlioncrimsonMatch3.0build_477.003

redlioncrimsonMatch3.0build_493.003

redlioncrimsonMatch3.0build_493.004

redlioncrimsonMatch3.0build_493.005

redlioncrimsonMatch3.0build_502.000

redlioncrimsonMatch3.0build_502.001

redlioncrimsonMatch3.0build_502.003

redlioncrimsonMatch3.0build_515.002

redlioncrimsonMatch3.0build_515.003

redlioncrimsonMatch3.0build_523.003

redlioncrimsonMatch3.0build_530.000

redlioncrimsonMatch3.0build_530.001

redlioncrimsonMatch3.0build_530.002

redlioncrimsonMatch3.0build_530.003

redlioncrimsonMatch3.0build_548.001

redlioncrimsonMatch3.0build_548.005

redlioncrimsonMatch3.0build_573.001

redlioncrimsonMatch3.0build_573.002

redlioncrimsonMatch3.0build_579.001

redlioncrimsonMatch3.0build_579.003

redlioncrimsonMatch3.0build_582.000

redlioncrimsonMatch3.0build_582.001

redlioncrimsonMatch3.0build_582.003

redlioncrimsonMatch3.0build_582.004

redlioncrimsonMatch3.0build_599.000

redlioncrimsonMatch3.0build_599.001

redlioncrimsonMatch3.0build_603.000

redlioncrimsonMatch3.0build_605.002

redlioncrimsonMatch3.0build_615.004

redlioncrimsonMatch3.0build_619.002

redlioncrimsonMatch3.0build_619.004

redlioncrimsonMatch3.0build_624.000

redlioncrimsonMatch3.0build_624.005

redlioncrimsonMatch3.0build_635.000

redlioncrimsonMatch3.0build_635.001

redlioncrimsonMatch3.0build_639.000

redlioncrimsonMatch3.0build_640.000

redlioncrimsonMatch3.0build_640.001

redlioncrimsonMatch3.0build_640.002

redlioncrimsonMatch3.0build_647.002

redlioncrimsonMatch3.0build_657.001

redlioncrimsonMatch3.0build_657.003

redlioncrimsonMatch3.0build_662.002

redlioncrimsonMatch3.0build_662.006

redlioncrimsonMatch3.0build_675.000

redlioncrimsonMatch3.0build_678.002

redlioncrimsonMatch3.0build_683.000

redlioncrimsonMatch3.0build_683.001

redlioncrimsonMatch3.0build_683.002

redlioncrimsonMatch3.0build_690.001

redlioncrimsonMatch3.0build_690.002

redlioncrimsonMatch3.0build_693.000

redlioncrimsonMatch3.0build_694.000

redlioncrimsonMatch3.0build_697.001

redlioncrimsonMatch3.0build_697.002

redlioncrimsonMatch3.0build_697.003

redlioncrimsonMatch3.0build_700.000

redlioncrimsonMatch3.0build_702.002

redlioncrimsonMatch3.0build_702.004

redlioncrimsonMatch3.0build_703.001

redlioncrimsonMatch3.0build_705.000

redlioncrimsonMatch3.0build_707.000

redlioncrimsonMatch3.1-

redlioncrimsonMatch3.1build_3100.000

redlioncrimsonMatch3.1build_3100.002

redlioncrimsonMatch3.1build_3100.003

redlioncrimsonMatch3.1build_3100.008

redlioncrimsonMatch3.1build_3100.009

redlioncrimsonMatch3.1build_3100.010

redlioncrimsonMatch3.1build_3101.001

redlioncrimsonMatch3.1build_3104.000

redlioncrimsonMatch3.1build_3106.000

redlioncrimsonMatch3.1build_3106.004

redlioncrimsonMatch3.1build_3108.002

redlioncrimsonMatch3.1build_3108.004

redlioncrimsonMatch3.1build_3109.003

redlioncrimsonMatch3.1build_3109.004

redlioncrimsonMatch3.1build_3110.000

redlioncrimsonMatch3.1build_3110.002

redlioncrimsonMatch3.1build_3110.004

redlioncrimsonMatch3.1build_3111.000

redlioncrimsonMatch3.1build_3112.000

redlioncrimsonMatch3.1build_3113.000

redlioncrimsonMatch3.1build_3114.002

redlioncrimsonMatch3.1build_3115.006

redlioncrimsonMatch3.1build_3115.008

redlioncrimsonMatch3.1build_3115.009

redlioncrimsonMatch3.1build_3116.000

redlioncrimsonMatch3.1build_3119.001

redlioncrimsonMatch3.1build_3119.002

redlioncrimsonMatch3.1build_3120.000

redlioncrimsonMatch3.1build_3120.001

redlioncrimsonMatch3.1build_3121.000

redlioncrimsonMatch3.1build_3122.000

redlioncrimsonMatch3.1build_3122.001

redlioncrimsonMatch3.1build_3123.000

redlioncrimsonMatch3.1build_3123.001

redlioncrimsonMatch3.1build_3124.000

redlioncrimsonMatch3.1build_3125.003

redlioncrimsonMatch3.1build_3125.006

redlioncrimsonMatch3.1build_3125.007

redlioncrimsonMatch3.1build_3126.000

redlioncrimsonMatch3.1build_3126.001

redlioncrimsonMatch3.2-

redlioncrimsonMatch3.2build_3.2.0008.0

redlioncrimsonMatch3.2build_3.2.0014.0

redlioncrimsonMatch3.2build_3.2.0015.0

redlioncrimsonMatch3.2build_3.2.0016.0

redlioncrimsonMatch3.2build_3.2.0020.0

redlioncrimsonMatch3.2build_3.2.0021.0

redlioncrimsonMatch3.2build_3.2.0025.0

redlioncrimsonMatch3.2build_3.2.0026.0

redlioncrimsonMatch3.2build_3.2.0030.0

redlioncrimsonMatch3.2build_3.2.0031.0

redlioncrimsonMatch3.2build_3.2.0035.0

redlioncrimsonMatch3.2build_3.2.0036.0

redlioncrimsonMatch3.2build_3.2.0040.0

redlioncrimsonMatch3.2build_3.2.0041.0

redlioncrimsonMatch3.2build_3.2.0044.0

CPENameOperatorVersion
redlion:crimsonredlion crimsonlt3.0
redlion:crimsonredlion crimsoneq3.1
redlion:crimsonredlion crimsoneq3.2

CPE	Name	Operator	Version
redlion:crimson	redlion crimson	lt	3.0
redlion:crimson	redlion crimson	eq	3.1
redlion:crimson	redlion crimson	eq	3.2

CNA Affected

[
  {
    "vendor": "Red Lion Controls",
    "product": "Crimson 3.0",
    "versions": [
      {
        "version": "All versions",
        "status": "affected",
        "lessThanOrEqual": "707.000",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Red Lion Controls",
    "product": "Crimson 3.1",
    "versions": [
      {
        "version": "All versions",
        "status": "affected",
        "lessThanOrEqual": "3126.001",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Red Lion Controls",
    "product": "Crimson 3.2",
    "versions": [
      {
        "version": "All versions",
        "status": "affected",
        "lessThanOrEqual": "3.2.0044.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-321-01

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.6%

JSON

Related for CVE-2022-3090

cvelist1 prion1 nvd1 ics1