CVE-2022-45047

🗓️ 16 Nov 2022 00:00:00Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 493 Views🌐 WEB

Apache MINA SSHD <= 2.9.1 vulnerability with Java deserializatio

Reporter	Title	Published	Views	Family All 127
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to unsafe deserialization due to Apache MINA SSHD (CVE-2022-45047)	21 Dec 202219:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilties affects IBM DB2 Data Management Console	6 Mar 202609:25	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in the IBM Spectrum Scale GUI where a remote authenticated user can execute commands [CVE-2022-45047]	14 Apr 202311:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	1 Jun 202523:30	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Sshd	7 Apr 202303:16	–	githubexploit
ATTACKERKB	CVE-2022-45047	16 Nov 202209:15	–	attackerkb
BDU FSTEC	Vulnerability of the org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider class in the Java library for supporting SSH protocol by Apache SSHD, allowing a hacker to execute arbitrary code.	12 Dec 202300:00	–	bdu_fstec
Broadcom	Deserialization of Untrusted Data affecting org.apache.sshd:sshd-common package (CVE-2022-45047)	23 May 202400:00	–	broadcom
Circl	CVE-2022-45047	17 Nov 202215:58	–	circl
CNNVD	Apache MINA 代码问题漏洞	16 Nov 202200:00	–	cnnvd

NVD

Vulners

Node

apache sshdRange≤2.9.1

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache MINA SSHD",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "2.9.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
mail-archive	www.mail-archive.com/dev%40mina.apache.org/msg39312.html
security	www.security.netapp.com/advisory/ntap-20240216-0008/

Parameter	Position	Path	Description	CWE
servers/AdminServer/tmp/_WL_internal/wls-wsat/4mcj4w/war/test.txt	request body	/_async/AsyncResponseService	Exploit payload targeting WebLogic CVE-2022-45047 via AsyncResponseService endpoint.	CWE-502

17 Jun 2026 05:09Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.03571

SSVC

CWE-502