CVE-2022-23862

Katalog CVE

CVSS 7.8 · High EPSS 0,49%

Kerentanan Missing Authentication for Critical Function pada ysoft safeq. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the vulnerability to execute arbitrary code and elevate to the system user.

Rincian

Terbit di NVD

22 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mbadanoiu/CVE-2022-23862 exploit · advisory pihak ketiga
• https://github.com/mbadanoiu/CVE-2022-23862/blob/main/SafeQ%20-%20CVE-2022-23862.pdf exploit
• https://ysoft.com product