CVE-2022-41223mediumunder attackransomwareCWE-94

CVE-2022-41223

Published · Updated

Follow this CVE+ Monitor MiVoice Connect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.8epss 11%
from disclosure to weapon
Published on NVDNov 22
CISA KEV+91d
Action required by CISAfederal deadline: 2023-03-14

Apply updates per vendor instructions.

In short

An authenticated user can inject malicious code into the MiVoice Connect database by sending specially crafted data. This happens because the database component doesn't properly validate the type of data being stored.

Technical detail

CWE-94 code injection vulnerability in MiVoice Connect Director database component (versions ≤19.3/22.22.6100.0) allows authenticated attackers to inject arbitrary code through insufficiently restricted database data types. The attack requires valid authentication credentials and exploits inadequate input validation on database operations.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a