CVE-2022-29942

Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://Talend.com	Vendor Advisory
https://www.talend.com/security/incident-response/#CVE-2022-29942	Vendor Advisory
https://Talend.com	Vendor Advisory
https://www.talend.com/security/incident-response/#CVE-2022-29942	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:talend:administration_center:7.2.0:::::::*
	cpe:2.3:a:talend:administration_center:7.3.0:::::::*
	cpe:2.3:a:talend:administration_center:8.0.0:::::::*

History

21 Nov 2024, 07:00

Type	Values Removed	Values Added
References	~~() https://Talend.com - Vendor Advisory~~	() https://Talend.com - Vendor Advisory
References	~~() https://www.talend.com/security/incident-response/#CVE-2022-29942 - Vendor Advisory~~	() https://www.talend.com/security/incident-response/#CVE-2022-29942 - Vendor Advisory

Information

Published : 2022-05-04 18:15

Updated : 2024-11-21 07:00

NVD link : CVE-2022-29942

Mitre link : CVE-2022-29942

CVE.ORG link : CVE-2022-29942

JSON object : View

Products Affected

talend

administration_center

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2022-29942", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-05-04T18:15:09.933", "references": [{"url": "https://Talend.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.talend.com/security/incident-response/#CVE-2022-29942", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://Talend.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.talend.com/security/incident-response/#CVE-2022-29942", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version."}, {"lang": "es", "value": "Talend Administration Center presenta una vulnerabilidad que permite a un usuario autenticado usar la funcionalidad Add\" del Registro de Servicios para llevar a cabo peticiones GET HTTP de tipo SSRF en URLs de la red interna. El problema ha sido corregido para las versiones 8.0.x en TPS-5189, las versiones 7.3.x en TPS-5175 y las versiones 7.2.x en TPS-5201. Las versiones anteriores de Talend Administration Center tambi\u00e9n pueden estar afectadas; es recomendado a usuarios actualizar a una versi\u00f3n compatible"}], "lastModified": "2024-11-21T07:00:01.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:talend:administration_center:7.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C41B793-589A-4E05-8DD0-5B124B9BC2E2"}, {"criteria": "cpe:2.3:a:talend:administration_center:7.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E86982F7-8EFB-4639-A295-41F1010EDDEE"}, {"criteria": "cpe:2.3:a:talend:administration_center:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "546FEC80-19A7-4E82-AF20-B096C184DCF1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}