Lucene search

MitreCVE-2022-40472

HistorySep 29, 2022 - 8:15 p.m.

CVE-2022-40472

2022-09-2920:15:14

CWE-1236

mitre

web.nvd.nist.gov

zkteco

xiamen

zkbio time

8.0.7

csv injection

vulnerability

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

46.8%

JSON

ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.

Affected configurations

Nvd

Node

zkteczkbio_timeMatch8.0.7

VendorProductVersionCPE
zkteczkbio_time8.0.7cpe:2.3:a:zktec:zkbio_time:8.0.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zktec	zkbio_time	8.0.7	cpe:2.3:a:zktec:zkbio_time:8.0.7:::::::*

References

the-it-wonders.blogspot.com/2022/09/zkbio-time-csv-injection.html

Social References

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

46.8%

JSON

Related for CVE-2022-40472