CVE-2022-4896 Denial of service in Control de Ciber
Attackers can cause a complete denial of service by sending multiple simultaneous requests to the Cyber Control server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4896?
CVE-2022-4896 is a high-severity denial of service vulnerability in Control de Ciber, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR", "HAYDISCOA" or "SPOOLER". A complete denial of service can be achieved by sending multiple requests simultaneously on a core.
Weakness: CWE-400
Which versions are affected by CVE-2022-4896?
It affects 1 product.
Products include Cbm Control De Ciber.
How do I fix CVE-2022-4896?
No fix has been published for CVE-2022-4896 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-4896 being exploited?
There is no known exploitation of CVE-2022-4896 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Control de Ciber
Sources
Also known as GHSA-pxc8-vcxh-r7r9.