CVE-2022-1399 Remote code execution in scheduled tasks component
A local attacker can execute arbitrary code with root privileges via argument injection in the Change Secret field of Device42 CMDB.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1399?
CVE-2022-1399 is a critical command injection vulnerability in Device42 CMDB, published on 16 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
Weakness: CWE-88
Which versions are affected by CVE-2022-1399?
It affects 1 product.
Products include Device42 Cmdb.
How do I fix CVE-2022-1399?
No fix has been published for CVE-2022-1399 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-1399 being exploited?
There is no known exploitation of CVE-2022-1399 in the wild and no public exploit code.
Other vulnerabilities in Device42 CMDB
Sources
Also known as GHSA-8vv8-q6f3-9jjg.