Lucene search

[email protected]NVD:CVE-2022-38130

HistoryAug 10, 2022 - 8:16 p.m.

CVE-2022-38130

2022-08-1020:16:06

CWE-89

[email protected]

web.nvd.nist.gov

keysight tentacle sms

remote attack

hsqldb

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

73.7%

JSON

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \<attacker-host>\sms<attacker-db.zip>), effectively controlling the content of the database to be restored.

Affected configurations

Nvd

Node

keysightsensor_management_serverMatch2.4.0

VendorProductVersionCPE
keysightsensor_management_server2.4.0cpe:2.3:a:keysight:sensor_management_server:2.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
keysight	sensor_management_server	2.4.0	cpe:2.3:a:keysight:sensor_management_server:2.4.0:::::::*

References

www.tenable.com/security/research/tra-2022-28

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

73.7%

JSON

Related for NVD:CVE-2022-38130

prion1 cvelist1 cve1