Lucene search

MitreCVE-2022-37108

HistorySep 07, 2022 - 2:15 p.m.

CVE-2022-37108

2022-09-0714:15:09

CWE-74

mitre

web.nvd.nist.gov

cve-2022-37108

injection vulnerability

securonix snypr

config wizard

arbitrary code execution

remote ingesters

nvd

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

47.3%

JSON

An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the “Manage Ingesters” permission to execute arbitrary code on remote ingesters by appending arbitrary text to text files that are executed by the system, such as users’ crontab files. The patch for this was present in SNYPR version 6.4 Jun 2022 R3_[06170871], but may have been introduced sooner.

Affected configurations

Nvd

Node

securonixsnyprMatch6.4

VendorProductVersionCPE
securonixsnypr6.4cpe:2.3:a:securonix:snypr:6.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
securonix	snypr	6.4	cpe:2.3:a:securonix:snypr:6.4:::::::*

References

conway.scot/securonix-rce/

Social References

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

47.3%

JSON

Related for CVE-2022-37108