Lucene search

[email protected]CVE-2022-41157

HistoryNov 25, 2022 - 7:15 p.m.

CVE-2022-41157

2022-11-2519:15:11

CWE-798

[email protected]

web.nvd.nist.gov

vulnerability

kyungrinara

erp

fixed password

system authority

information leakage

sensitive information

malicious commands

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.0%

JSON

A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.

Affected configurations

NVD

Node

microsoftwindowsMatch-

AND

webcashserp_server_2.0Range<20.2.161

CPENameOperatorVersion
webcash:serp_server_2.0webcash serp server 2.0lt20.2.161

CPE	Name	Operator	Version
webcash:serp_server_2.0	webcash serp server 2.0	lt	20.2.161

CNA Affected

[
  {
    "vendor": "Webcash Co.,Ltd",
    "product": "sERP Server 2.0",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "20.2.161",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Windows"
    ]
  }
]

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67042

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.0%

JSON

Related for CVE-2022-41157

nvd1 cvelist1 prion1