CVE-2022-41705

2022-11-2518:15:10

CWE-434

Fluid Attacks

web.nvd.nist.gov

cve-2022-41705

badaso

unauthenticated

remote code execution

security vulnerability

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.005

Percentile

77.6%

JSON

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

Affected configurations

Nvd

Node

uatechbadasoMatch2.6.3

VendorProductVersionCPE
uatechbadaso2.6.3cpe:2.3:a:uatech:badaso:2.6.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
uatech	badaso	2.6.3	cpe:2.3:a:uatech:badaso:2.6.3:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Badaso",
    "versions": [
      {
        "version": "2.6.3",
        "status": "affected"
      }
    ]
  }
]