CVE-2022-4257

🗓️ 01 Dec 2022 00:00:00Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 191 Views🌐 WEB

A critical vulnerability in C-DATA Web Management System allows remote attackers to inject arguments via the hostname parameter in cgi-bin/jumpto.php, leading to argument injection. (CVE-2022-4257

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2022-4257	1 Dec 202200:00	–	attackerkb
Circl	CVE-2022-4257	1 Dec 202218:35	–	circl
CNNVD	C-DATA Web Management System 操作系统命令注入漏洞	1 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-4257 C-DATA Web Management System GET Parameter jumpto.php argument injection	1 Dec 202200:00	–	cvelist
EUVD	EUVD-2022-51613	3 Oct 202520:07	–	euvd
NVD	CVE-2022-4257	1 Dec 202215:15	–	nvd
Prion	Design/Logic Flaw	1 Dec 202215:15	–	prion
Positive Technologies	PT-2022-26501 · Unknown · C-Data Web Management System	1 Dec 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-4257	22 May 202523:48	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2022-4257	15 Feb 202300:00	–	vulncheck_kev

NVD

Node

cdatatec c-data_web_management_systemMatch-

[
  {
    "vendor": "C-DATA",
    "product": "Web Management System",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md

Parameter	Position	Path	Description	CWE
hostname	query param	cgi-bin/jumpto.php	Manipulation of the hostname parameter in cgi-bin/jumpto.php leading to argument injection.	CWE-707, CWE-78

21 Nov 2024 07:34Current

8.3High risk

Vulners AI Score8.3

CVSS 3.16.3 - 9.8

EPSS0.01923

SSVC

vulnerability c-data web management system critical cve-2022-4257 argument injection remote attack