CVE-2022-29549

Katalog CVE

CVSS 7.3 · High EPSS 0,28%

Kerentanan Improper Validation of Integrity Check Value pada qualys cloud agent for linux. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e.g., to help ensure that a program was installed by root) and without integrity checks (e.g., a checksum comparison against known legitimate programs). Also, the vendor recommendation is to install this agent software with root privileges. Thus, privilege escalation is possible on systems where any of these pathnames is controlled by a non-root user. An example is /opt/firebird/bin/isql, where the /opt/firebird directory is often owned by the firebird user.

Rincian

Terbit di NVD

18 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linux advisory vendor
• https://blog.qualys.com/vulnerabilities-threat-research advisory vendor
• http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.html advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Sep/10 mailing list · advisory pihak ketiga
• http://software.firstworks.com/p/getting-started-with-firebird.html not applicable