CVE-2022-3276
説明
A flaw was in the puppetlabs-mysql module, where a Command injection can occur. This flaw allows a malicious actor to provide unsanitized input to the module.
詳細
This condition is rare in most deployments of Puppet and Puppet Enterprise.
CVSS (Common Vulnerability Scoring System) のスコアの詳細
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 スコアの内訳
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| ベーススコア | 8.4 | 8.8 | N/A |
| 攻撃ベクトル | Adjacent Network | Network | N/A |
| 攻撃の複雑さ | Low | Low | N/A |
| 必要な権限 | High | Low | N/A |
| ユーザー関与レベル | None | None | N/A |
| 範囲 | Changed | Unchanged | N/A |
| 機密性 | High | High | N/A |
| 完全性への影響 | High | High | N/A |
| 可用性への影響 | High | High | N/A |
ベクトル
Red Hat: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
脆弱性の原因 (CWE) の理解
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
よくある質問
Not sure what something means? Check out our Security Glossary.
エラータ通知の受信を希望しますか? こちらで登録してください。
