Lucene search

VulDBCVE-2022-4823

HistoryDec 28, 2022 - 9:15 p.m.

CVE-2022-4823

2022-12-2821:15:11

CWE-203

CWE-208

VulDB

web.nvd.nist.gov

cve-2022-4823

instedd nuntium

geopoll_controller.rb

remote attack

timing discrepancy

patch 77236f7fd71a0e2eefeea07f9866b069d612cf0d

vdb-217002

nvd

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

45.4%

JSON

A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.

Affected configurations

Nvd

Node

insteddnuntiumRange<2022-11-23

VendorProductVersionCPE
insteddnuntium*cpe:2.3:a:instedd:nuntium:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
instedd	nuntium	*	cpe:2.3:a:instedd:nuntium::::::::

CNA Affected

[
  {
    "vendor": "InSTEDD",
    "product": "Nuntium",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

References

github.com/instedd/nuntium/commit/77236f7fd71a0e2eefeea07f9866b069d612cf0d

vuldb.com/?ctiid.217002

vuldb.com/?id.217002

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

45.4%

JSON

Related for CVE-2022-4823