CVE-2022-4257mediumobserved exploitationCWE-707

CVE-2022-4257: medium-severity vulnerability in C-DATA Web Management System

C-DATA Web Management System GET Parameter jumpto.php argument injection

Published · Updated

Follow this CVE+ Monitor Web Management System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

67Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 6.3epss 44%
from disclosure to weapon1440 days
Published on NVDDec 1
1st PoC+1440d
VulnCheck+76d
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
C-DATA · Web Management System
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — C-DATA Web Management System

In the same product, most dangerous first.

CVE-2023-3305HIGHC-DATA Web Management System User Creation access controlEPSS 0.8%