Lucene search

KrcertCVE-2022-41156

HistoryNov 25, 2022 - 7:15 p.m.

CVE-2022-41156

2022-11-2519:15:11

CWE-345

krcert

web.nvd.nist.gov

cve-2022-41156

remote code execution

ondiskplayeragent

url verification

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

41.7%

JSON

Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.

Affected configurations

Nvd

Node

microsoftwindowsMatch-

AND

etm-sondiskplayeragentMatch1.3.8.12

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
etm-sondiskplayeragent1.3.8.12cpe:2.3:a:etm-s:ondiskplayeragent:1.3.8.12:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
etm-s	ondiskplayeragent	1.3.8.12	cpe:2.3:a:etm-s:ondiskplayeragent:1.3.8.12:::::::*

CNA Affected

[
  {
    "vendor": "ETMS Co.,Ltd",
    "product": "OndiskPlayerAgent",
    "versions": [
      {
        "version": "1.3.8.12",
        "status": "affected"
      }
    ],
    "platforms": [
      "Windows"
    ]
  }
]

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67041

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

41.7%

JSON

Related for CVE-2022-41156