CVE-2022-0551CWE-20

Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0

High · published March 24, 2022

CVSS v4.0
8.6
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00904 · 59.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-03-24T14:15Z
EPSS history
Timeline
  • 24 MAR 14:15Z
    Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0
    cvelistv5