Lucene search
HistoryJul 29, 2022 - 5:15 p.m.
CVE-2022-35629
bug handling communication
client id
velociraptor 0.6.5-2
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS
0.001
Percentile
22.7%
Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issue was resolved in Velociraptor 0.6.5-2.
Affected configurations
Node
rapid7velociraptorRange<0.6.5-2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| rapid7 | velociraptor | * | cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2022-35629 Velociraptor Client ID Spoofing
2022-07-29 17:00:21
cve
cve
CVE-2022-35629
2022-07-29 17:15:09
prion
prion
Code injection
2022-07-29 17:15:00
rapid7blog
rapid7blog
CVE-2022-35629..35632 Velociraptor Multiple Vulnerabilities (FIXED)
2022-07-26 17:15:00
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS
0.001
Percentile
22.7%
Related for NVD:CVE-2022-35629