Lucene search

MitreCVE-2022-46408

HistoryJun 29, 2023 - 3:15 a.m.

CVE-2022-46408

2023-06-2903:15:09

CWE-1236

mitre

web.nvd.nist.gov

cve-2022-46408

ericsson

network manager

enm

csv injection

remote code execution

data leakage

vulnerability

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

53.1%

JSON

Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where improper Neutralization of Formula Elements in a CSV File can lead to remote code execution or data leakage via maliciously injected hyperlinks. The attacker would need admin/elevated access to exploit the vulnerability.

Affected configurations

Nvd

Node

ericssonnetwork_managerRange<22.1

VendorProductVersionCPE
ericssonnetwork_manager*cpe:2.3:a:ericsson:network_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ericsson	network_manager	*	cpe:2.3:a:ericsson:network_manager::::::::

References

www.gruppotim.it/it/footer/red-team.html

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

53.1%

JSON

Related for CVE-2022-46408