CVE-2022-50789highCWE-78

CVE-2022-50789: fallo de gravedad alta en Kantar Media WM2

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WM2+ Monitorear BigVoice2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 4.2%
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid extension. Unauthenticated attackers can execute the malicious commands by making a single HTTP POST request to the vulnerable dns.php script, which triggers command execution and then deletes the file.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Kantar Media · WM2SOUND4 Ltd. · BigVoice2SOUND4 Ltd. · BigVoice4SOUND4 Ltd. · Impact/Pulse EcoSOUND4 Ltd. · Impact/Pulse/FirstSOUND4 Ltd. · Stream
CVEs relacionadas — Kantar Media WM2

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-50795HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpEPSS 4.2%CVE-2022-50791HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.phpEPSS 3.8%CVE-2022-50794CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via UsernameEPSS 3.7%CVE-2023-53963CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command InjectionEPSS 3.4%CVE-2022-50793HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.phpEPSS 3.1%CVE-2022-50792HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated File Disclosure VulnerabilityEPSS 1.6%