Lucene search

[email protected]CVE-2022-38340

HistorySep 20, 2022 - 6:15 p.m.

CVE-2022-38340

2022-09-2018:15:10

CWE-22

[email protected]

web.nvd.nist.gov

cve-2022-38340

safe software

fme server

path traversal

vulnerability

nvd

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

61.3%

JSON

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.

Affected configurations

NVD

Node

safefme_serverRange<2021.2.6

safefme_serverRange2022.0.0.0–2022.0.1

CPENameOperatorVersion
safe:fme_serversafe fme serverlt2021.2.6
safe:fme_serversafe fme serverlt2022.0.1

CPE	Name	Operator	Version
safe:fme_server	safe fme server	lt	2021.2.6
safe:fme_server	safe fme server	lt	2022.0.1

References

community.safe.com/s/article/Known-Issue-Arbitrary-file-upload-with-any-authenticated-FME-Server-account

community.safe.com/s/article/Known-Issue-FME-Server-vulnerability-with-arbitrary-path-traversal-and-file-upload

www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/

Social References

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

61.3%

JSON

Related for CVE-2022-38340

cvelist1 prion1 nvd1