CVE-2022-41958highCWE-502

CVE-2022-41958: falha de alta gravidade em 4ra1n super-xray

Deserialization Vulnerability by yaml config input in super-xray

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar super-xray

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.5%
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
4ra1n · super-xray
CVEs relacionadas — 4ra1n super-xray

No mesmo produto, das mais perigosas para as menos.

CVE-2022-41945MEDIUMRemote Code Execution (RCE) vulnerability in super-xray via URL inputEPSS 0.8%CVE-2022-41950MEDIUMPrivilege Escalation Vulnerability by wrong chmod paramEPSS 0.4%