CVE-2022-27534

Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2	Broken Link
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:kaspersky:anti-virus::::::::
	cpe:2.3:a:kaspersky:endpoint_security::::::::
	cpe:2.3:a:kaspersky:internet_security::::::::
	cpe:2.3:a:kaspersky:security_cloud::::::::
	cpe:2.3:a:kaspersky:small_office_security::::::::
	cpe:2.3:a:kaspersky:total_security::::::::

History

21 Nov 2024, 06:55

Type	Values Removed	Values Added
References	~~() https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2 - Broken Link~~	() https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2 - Broken Link

Information

Published : 2022-04-01 23:15

Updated : 2024-11-21 06:55

NVD link : CVE-2022-27534

Mitre link : CVE-2022-27534

CVE.ORG link : CVE-2022-27534

JSON object : View

Products Affected

kaspersky

security_cloud
small_office_security
endpoint_security
total_security
internet_security
anti-virus

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-27534", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-04-01T23:15:14.747", "references": [{"url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2", "tags": ["Broken Link"], "source": "vulnerability@kaspersky.com"}, {"url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies)."}, {"lang": "es", "value": "Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases lanzados antes del 12 de marzo de 2022, ten\u00edan un error en un m\u00f3dulo de an\u00e1lisis de datos que potencialmente permit\u00eda a un atacante ejecutar c\u00f3digo arbitrario. La correcci\u00f3n fue realizada de forma autom\u00e1tica. Cr\u00e9ditos: Georgy Zaytsev (Positive Technologies)"}], "lastModified": "2024-11-21T06:55:53.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kaspersky:anti-virus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BAFD804-D268-40E2-9EAE-FAC4B370985A", "versionEndExcluding": "12.03.2022"}, {"criteria": "cpe:2.3:a:kaspersky:endpoint_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54AFE429-3D4B-49D4-AC0D-FEDEB99A9187", "versionEndExcluding": "12.03.2022"}, {"criteria": "cpe:2.3:a:kaspersky:internet_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72568879-E182-46DC-99D1-FFF4C133FB3F", "versionEndExcluding": "12.03.2022"}, {"criteria": "cpe:2.3:a:kaspersky:security_cloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "247E7C3E-89E3-46D4-A12E-4DC322A057AE", "versionEndExcluding": "12.03.2022"}, {"criteria": "cpe:2.3:a:kaspersky:small_office_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5D6EC78-AD45-4FE8-AEB3-48C76A394925", "versionEndExcluding": "12.03.2022"}, {"criteria": "cpe:2.3:a:kaspersky:total_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E53C7C9C-8A52-4F39-AB0D-D906B5936D86", "versionEndExcluding": "12.03.2022"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@kaspersky.com"}