CVE-2022-4823 InSTEDD Nuntium geopoll_controller.rb timing discrepancy
Remote attackers can exploit timing discrepancies in signature validation to potentially disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4823?
CVE-2022-4823 is a low-severity vulnerability in InSTEDD Nuntium, published on 28 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.
Which versions are affected by CVE-2022-4823?
It affects 1 product.
Products include Instedd Nuntium.
How do I fix CVE-2022-4823?
No fix has been published for CVE-2022-4823 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4823 being exploited?
There is no known exploitation of CVE-2022-4823 in the wild and no public exploit code.
Sources
Also known as GHSA-9f3h-4xvq-5r5q.