CVE-2022-28228

{"id": "CVE-2022-28228", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2022-12-23T22:15:08.647", "references": [{"url": "https://ydb.tech/ru/docs/security-changelog#28-11-2022", "tags": ["Vendor Advisory"], "source": "browser-security@yandex-team.ru"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would allow him to read sensitive information from other memory locations or cause a crash."}, {"lang": "es", "value": "Se descubri\u00f3 una lectura fuera de los l\u00edmites en el servidor YDB. Un atacante podr\u00eda crear una consulta con una instrucci\u00f3n de inserci\u00f3n que le permitir\u00eda leer informaci\u00f3n confidencial de otras ubicaciones de la memoria o provocar un bloqueo."}], "lastModified": "2023-01-04T18:59:47.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ydb:ydb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9F9AD21-6335-40AF-BFCC-1C87D69FF564", "versionEndExcluding": "24.4.44"}], "operator": "OR"}]}], "sourceIdentifier": "browser-security@yandex-team.ru"}