CVE-2022-40238 A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5

What is CVE-2022-40238?

CVE-2022-40238 is a high-severity unsafe deserialization vulnerability in CERT/CC VINCE - The Vulnerability Information and Coordination Environment, published on 26 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

Weakness: CWE-502

Which versions are affected by CVE-2022-40238?

It affects 1 product.

Products include Cert Vince.

How do I fix CVE-2022-40238?

No fix has been published for CVE-2022-40238 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-40238 being exploited?

There is no known exploitation of CVE-2022-40238 in the wild and no public exploit code.

Other vulnerabilities in CERT/CC VINCE - The Vulnerability Information and Coordination Environment

• CVE-2022-25799 An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0 Medium 6.1
• CVE-2022-40248 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 Medium 5.4
• CVE-2022-40257 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 Medium 5.4
• CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8 Medium 4.9
• CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view. Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9gw9-mrm5-m5x9.