CVE-2022-20718

Katalog CVE

CVSS 7.2 · High EPSS 2,4%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada cisco ios xe. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.

Rincian

Terbit di NVD

15 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 139 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj advisory vendor
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-px2c-q384-5wxc exploit · advisory pihak ketiga