CVE-2022-36006

Katalog CVE

CVSS 8.8 · High EPSS 1,7%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada arvados. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution (RCE) vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This exists in all versions up to 2.4.1 and is fixed in 2.4.2. This vulnerability is specific to the Ruby on Rails Workbench application (“Workbench 1”). We do not believe any other Arvados components, including the TypesScript browser-based Workbench application (“Workbench 2”) or API Server, are vulnerable to this attack. For versions of Arvados earlier than 2.4.2: remove the Ruby-based "Workbench 1" app ("apt-get remove arvados-workbench") from your installation as a workaround.

Rincian

Terbit di NVD

15 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://arvados.org/release-notes/2.4.2/ advisory vendor
• https://dev.arvados.org/issues/19316 issue tracking · advisory vendor
• https://github.com/arvados/arvados/security/advisories/GHSA-8867-q4xf-cqgm advisory pihak ketiga