Lucene search

IcscertCVELIST:CVE-2022-1359

HistoryMay 17, 2022 - 8:15 p.m.

CVE-2022-1359 Cambium Networks cnMaestro Path Traversal

2022-05-1720:15:55

CWE-78

icscert

www.cve.org

cambium networks

cnmaestro

path traversal

security vulnerability

file write

pathname limitation

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

34.6%

JSON

The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specific route. If an attacker supplied path traversal charters (…/) as part of a filename, the server will save the file where the attacker chooses. This could allow an attacker to write any data to any file in the server.

CNA Affected

[
  {
    "product": "cnMaestro",
    "vendor": "Cambium Networks",
    "versions": [
      {
        "lessThan": "3.0.3-r32",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "2.4.2-r29",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.0-r34",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-132-04

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

34.6%

JSON

Related for CVELIST:CVE-2022-1359