CVE-2022-3549

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Ramansh123454/POCs/blob/main/CSMS_RCE	Third Party Advisory
https://vuldb.com/?id.211049	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oretnom23:simple_cold_storage_management_system:1.0:*:*:*:*:*:*:*

History

28 Dec 2023, 16:46

Type	Values Removed	Values Added
CPE	cpe:2.3:a:simple_cold_storage_management_system_project:simple_cold_storage_management_system:1.0:::::::*	cpe:2.3:a:oretnom23:simple_cold_storage_management_system:1.0:::::::*
First Time		Oretnom23 simple Cold Storage Management System Oretnom23

Information

Published : 2022-10-17 12:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-3549

Mitre link : CVE-2022-3549

CVE.ORG link : CVE-2022-3549

JSON object : View

Products Affected

oretnom23

simple_cold_storage_management_system

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2022-3549", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}]}, "published": "2022-10-17T12:15:11.473", "references": [{"url": "https://github.com/Ramansh123454/POCs/blob/main/CSMS_RCE", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.211049", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en SourceCodester Simple Cold Storage Management System versi\u00f3n 1.0. Ha sido calificada como problem\u00e1tica. Este problema afecta a un procesamiento desconocido del archivo /csms/admin/?page=user/manage_user del componente Avatar Handler. La manipulaci\u00f3n conlleva a una descarga sin restricciones. El ataque puede ser iniciado remotamente. La explotaci\u00f3n ha sido divulgada al p\u00fablico y puede ser usada. El identificador VDB-211049 fue asignado a esta vulnerabilidad"}], "lastModified": "2023-12-28T16:46:19.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oretnom23:simple_cold_storage_management_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46B90B33-68A7-49D0-AC82-B19068310C9C"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}