CVE-2022-28875

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://www.f-secure.com/en/business/support-and-downloads/security-advisories	Vendor Advisory
https://www.withsecure.com/en/support/security-advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f-secure:atlant:-:::::::*
	cpe:2.3:a:f-secure:cloud_protection_for_salesforce:-:::::::*
	cpe:2.3:a:f-secure:elements_collaboration_protection:-:::::::*
	cpe:2.3:a:f-secure:internet_gatekeeper:-:::::-::
	cpe:2.3:a:f-secure:linux_security:-:::::::*

Configuration 2 (hide)

AND

OR	cpe:2.3:a:f-secure:elements_endpoint_detection_and_response:-:::::::*
	cpe:2.3:a:f-secure:elements_endpoint_protection:-:::::::*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2022-05-25 16:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-28875

Mitre link : CVE-2022-28875

CVE.ORG link : CVE-2022-28875

JSON object : View

Products Affected

f-secure

atlant
linux_security
elements_endpoint_detection_and_response
elements_endpoint_protection
cloud_protection_for_salesforce
internet_gatekeeper
elements_collaboration_protection

apple

macos

microsoft

windows

CWE

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2022-28875", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve-notifications-us@f-secure.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.9}]}, "published": "2022-05-25T16:15:08.297", "references": [{"url": "https://www.f-secure.com/en/business/support-and-downloads/security-advisories", "tags": ["Vendor Advisory"], "source": "cve-notifications-us@f-secure.com"}, {"url": "https://www.withsecure.com/en/support/security-advisories", "tags": ["Vendor Advisory"], "source": "cve-notifications-us@f-secure.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de Denegaci\u00f3n de Servicio (DoS) en F-Secure Atlant y en determinados productos WithSecure por la que el escaneo del componente aemobile puede bloquear el motor de escaneo. La explotaci\u00f3n puede ser activado remotamente por un atacante"}], "lastModified": "2022-06-08T15:13:07.440", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f-secure:atlant:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A8AF772-E3DC-4C9B-B3E8-81103D3B7BC4"}, {"criteria": "cpe:2.3:a:f-secure:cloud_protection_for_salesforce:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F04F9410-836A-428B-9959-4662E79D963D"}, {"criteria": "cpe:2.3:a:f-secure:elements_collaboration_protection:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D28AA80A-1FF6-4DD6-BCCB-C455C2BB5032"}, {"criteria": "cpe:2.3:a:f-secure:internet_gatekeeper:-:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "716021F0-35B9-4567-838A-DAEC65A6601F"}, {"criteria": "cpe:2.3:a:f-secure:linux_security:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEDCC601-0F8F-4D23-9DE1-5B4B72C689AE"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f-secure:elements_endpoint_detection_and_response:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27EDA251-BB9B-4394-B653-145603D0EEA5"}, {"criteria": "cpe:2.3:a:f-secure:elements_endpoint_protection:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7098F9BA-B2C0-4310-96D5-D0134761F7A6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve-notifications-us@f-secure.com"}