Lucene search

MitreCVE-2022-32270

HistoryJun 03, 2022 - 6:15 a.m.

CVE-2022-32270

2022-06-0306:15:07

CWE-22

mitre

web.nvd.nist.gov

real player

cve-2022-32270

arbitrary file download

remote code execution

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.006

Percentile

78.2%

JSON

In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).

Affected configurations

Nvd

Node

realnetworksrealplayerMatch20.0.7.309

realnetworksrealplayerMatch20.0.8.310

VendorProductVersionCPE
realnetworksrealplayer20.0.7.309cpe:2.3:a:realnetworks:realplayer:20.0.7.309:*:*:*:*:*:*:*
realnetworksrealplayer20.0.8.310cpe:2.3:a:realnetworks:realplayer:20.0.8.310:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
realnetworks	realplayer	20.0.7.309	cpe:2.3:a:realnetworks:realplayer:20.0.7.309:::::::*
realnetworks	realplayer	20.0.8.310	cpe:2.3:a:realnetworks:realplayer:20.0.8.310:::::::*

References

github.com/Edubr2020/RP_Import_RCE

youtu.be/CONlijEgDLc

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.006

Percentile

78.2%

JSON

Related for CVE-2022-32270