Lucene search

GoogleOSV:CVE-2022-46478

HistoryJan 13, 2023 - 1:15 a.m.

CVE-2022-46478

2023-01-1301:15:10

Google

osv.dev

rpc interface

datax-web

permission checks

arbitrary commands

hessian serialized data

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.1%

JSON

The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.

CPENameOperatorVersion
datax-webeq2.0.0
datax-webeq2.0.1
datax-webeq2.1.0
datax-webeq1.0.0
datax-webeq-2.1.2
datax-webeq-2.1.1

Name	Operator	Version
datax-web	eq	2.0.0
datax-web	eq	2.0.1
datax-web	eq	2.1.0
datax-web	eq	1.0.0
datax-web	eq	-2.1.2
datax-web	eq	-2.1.1

References

github.com/WeiYe-Jing/datax-web/issues/587

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.1%

JSON

Related for OSV:CVE-2022-46478