Lucene search

TwcertCVE-2022-35223

HistoryAug 02, 2022 - 4:15 p.m.

CVE-2022-35223

2022-08-0216:15:10

CWE-502

twcert

web.nvd.nist.gov

cve-2022-35223

easyuse

mailhunter ultimate

cookie deserialization

insecure deserialization

remote code execution

system manipulation

service interruption

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.004

Percentile

73.5%

JSON

EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.

Affected configurations

Nvd

Node

easyusemailhunter_ultimateRange≤2020

VendorProductVersionCPE
easyusemailhunter_ultimate*cpe:2.3:a:easyuse:mailhunter_ultimate:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
easyuse	mailhunter_ultimate	*	cpe:2.3:a:easyuse:mailhunter_ultimate::::::::

CNA Affected

[
  {
    "product": "MailHunter Ultimate",
    "vendor": "EasyUse",
    "versions": [
      {
        "lessThanOrEqual": "2020",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.chtsecurity.com/news/a381467e-74ff-4a8c-a4d3-fc86720f5400

www.twcert.org.tw/tw/cp-132-6365-b056c-1.html

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.004

Percentile

73.5%

JSON

Related for CVE-2022-35223