CVE-2022-38451

2023-01-3011:15:09

CWE-22

[email protected]

web.nvd.nist.gov

cve-2022-38451

directory traversal

httpd update.cgi

freshtomato

vulnerability

arbitrary file read

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.6 High

AI Score

Confidence

High

JSON

A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.

CPE configuration

Vulners

NVD

freshtomatofreshtomatoRange≤2022.5

sirettaquartz-goldRange≤G5.0.1.5-210720-141020

VendorProductVersionCPE
freshtomatofreshtomato*cpe:2.3:o:freshtomato:freshtomato:*:*:*:*:*:*:*:*
freshtomatofreshtomato*cpe:2.3:o:freshtomato:freshtomato:*:*:*:*:*:*:*:*
freshtomatofreshtomato*cpe:2.3:o:freshtomato:freshtomato:*:*:*:*:*:*:*:*
sirettaquartz\-gold*cpe:2.3:h:siretta:quartz\-gold:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
freshtomato	freshtomato	*	cpe:2.3:o:freshtomato:freshtomato::::::::
freshtomato	freshtomato	*	cpe:2.3:o:freshtomato:freshtomato::::::::
freshtomato	freshtomato	*	cpe:2.3:o:freshtomato:freshtomato::::::::
siretta	quartz\-gold	*	cpe:2.3:h:siretta:quartz\-gold::::::::

CNA Affected

[
  {
    "vendor": "FreshTomato",
    "product": "FreshTomato",
    "versions": [
      {
        "version": "2022.5",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "FreshTomato",
    "product": "FreshTomato",
    "versions": [
      {
        "version": "2022.5",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "FreshTomato",
    "product": "FreshTomato",
    "versions": [
      {
        "version": "2022.5",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siretta",
    "product": "QUARTZ-GOLD",
    "versions": [
      {
        "version": "G5.0.1.5-210720-141020",
        "status": "affected"
      }
    ]
  }
]