deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22985
Published: 2022-03-10
Description: The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to review history.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01
CVE: CVE-2022-23383
Published: 2022-03-10
Description: YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://yzmcms.com; https://down.chinaz.com/soft/37810.htm; https://www.cnvd.org.cn/user/myreport/6499961
CVE: CVE-2022-23940
Published: 2022-03-10
Description: SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://docs.suitecrm.com/8.x/admin/releases/8.0/; https://github.com/manuelz120; https://docs.suitecrm.com/8.x/admin/releases/8.0/
CVE: CVE-2022-24177
Published: 2022-03-10
Description: A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zhao1231/cve_payload/issues/1; https://github.com/zhao1231/cve_payload/issues/1
CVE: CVE-2022-24193
Published: 2022-03-10
Description: CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/IceWhaleTech/CasaOS/commit/d060968b7ab08e7f8cbfe7ca9ccdfa47afe9bb06; https://github.com/IceWhaleTech/CasaOS/issues/84; https://www.star123.top/2022/01/08/A-vulnerability-in-CasaOS/
CVE: CVE-2022-24285
Published: 2022-03-10
Description: Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority called ACCsvc through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://community.acer.com/en/kb/articles/14761; https://community.acer.com/en/kb/articles/14761
CVE: CVE-2022-24286
Published: 2022-03-10
Description: Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://community.acer.com/en/kb/articles/14762; https://community.acer.com/en/kb/articles/14762
CVE: CVE-2022-24395
Published: 2022-03-10
Description: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10; https://launchpad.support.sap.com/#/notes/3146261; https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE: CVE-2022-24396
Published: 2022-03-10
Description: The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html; http://seclists.org/fulldisclosure/2022/Jun/38; https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE: CVE-2022-24397
Published: 2022-03-10
Description: SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.This reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content of portal Website. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10; https://launchpad.support.sap.com/#/notes/3146260; https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE: CVE-2022-24398
Published: 2022-03-10
Description: Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which would otherwise be restricted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10; https://launchpad.support.sap.com/#/notes/3103424; https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE: CVE-2022-24399
Published: 2022-03-10
Description: The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/167559/SAP-FRUN-2.00-3.00-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2022/Jun/37; https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE: CVE-2022-24432
Published: 2022-03-10
Description: Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01
CVE: CVE-2022-24600
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_g; https://github.com/jsjbcyber/bug_report/blob/main/bug_g
CVE: CVE-2022-24601
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injection statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_h; https://github.com/jsjbcyber/bug_report/blob/main/bug_h
CVE: CVE-2022-24602
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_i; https://github.com/jsjbcyber/bug_report/blob/main/bug_i
CVE: CVE-2022-24603
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_j; https://github.com/jsjbcyber/bug_report/blob/main/bug_j
CVE: CVE-2022-24604
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_k; https://github.com/jsjbcyber/bug_report/blob/main/bug_k
CVE: CVE-2022-24605
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_l; https://github.com/jsjbcyber/bug_report/blob/main/bug_l
CVE: CVE-2022-24606
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_m; https://github.com/jsjbcyber/bug_report/blob/main/bug_m
CVE: CVE-2022-24607
Published: 2022-03-10
Description: Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_n; https://github.com/jsjbcyber/bug_report/blob/main/bug_n
CVE: CVE-2022-24608
Published: 2022-03-10
Description: Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_o; https://github.com/jsjbcyber/bug_report/blob/main/bug_o
CVE: CVE-2022-24609
Published: 2022-03-10
Description: Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/jsjbcyber/bug_report/blob/main/bug_p; https://github.com/jsjbcyber/bug_report/blob/main/bug_p
CVE: CVE-2022-24618
Published: 2022-03-10
Description: Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: http://heimdal.com; https://support.heimdalsecurity.com/hc/en-us/articles/[PII_REDACTED]473-2-5-398-PROD-and-2-5-401-RC; http://heimdal.com
CVE: CVE-2022-24644
Published: 2022-03-10
Description: ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger an update of an affected installation of KeyMouse.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: http://keymouse.com; https://github.com/gerr-re/cve-2022-24644/blob/main/cve-2022-24644_public-advisory.pdf; http://keymouse.com
CVE: CVE-2022-24651
Published: 2022-03-10
Description: sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://blog.hanayuzu.top/articles/37dacab4.html; https://blog.hanayuzu.top/articles/37dacab4.html
CVE: CVE-2022-24652
Published: 2022-03-10
Description: sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://blog.hanayuzu.top/articles/37dacab4.html; https://blog.hanayuzu.top/articles/37dacab4.html
CVE: CVE-2022-24915
Published: 2022-03-10
Description: The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01
CVE: CVE-2022-24928
Published: 2022-03-10
Description: Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-815
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE: CVE-2022-24929
Published: 2022-03-10
Description: Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-926
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE: CVE-2022-24930
Published: 2022-03-10
Description: An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to reset default app settings without a proper permission
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE: CVE-2022-24931
Published: 2022-03-10
Description: Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary activity without a proper permission
CVSS Score: 7.9 (HIGH)
CWE: CWE-269
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE: CVE-2022-24932
Published: 2022-03-10
Description: Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-424
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE: CVE-2022-24960
Published: 2022-03-10
Description: A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This issue affects: PDFTron PDFTron SDK 9.2.0 on OSX; 9.2.0 on Linux; 9.2.0 on Windows.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/suletm/security_research/blob/main/CVE/CVE-2022-24960.json; https://www.pdftron.com/nightly/#stable/2022-02-08/9.2/; https://github.com/suletm/security_research/blob/main/CVE/CVE-2022-24960.json
CVE: CVE-2022-24995
Published: 2022-03-10
Description: Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/7; https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/7
CVE: CVE-2022-25090
Published: 2022-03-10
Description: Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://packetstormsecurity.com/files/166242/Printix-Client-1.3.1106.0-Privilege-Escalation.html; http://packetstormsecurity.com/files/167012/Printix-1.3.1106.0-Privilege-Escalation.html; http://printix.com
CVE: CVE-2022-25108
Published: 2022-03-10
Description: Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without proper validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-25213
Published: 2022-03-10
Description: Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://www.tenable.com/security/research/tra-2022-01; https://www.tenable.com/security/research/tra-2022-01
CVE: CVE-2022-25214
Published: 2022-03-10
Description: Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.
CVSS Score: 7.4 (HIGH)
References: https://www.tenable.com/security/research/tra-2022-01; https://www.tenable.com/security/research/tra-2022-01
CVE: CVE-2022-25215
Published: 2022-03-10
Description: Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.
CVSS Score: 5.3 (MEDIUM)
References: https://www.tenable.com/security/research/tra-2022-01; https://www.tenable.com/security/research/tra-2022-01
CVE: CVE-2022-25217
Published: 2022-03-10
Description: Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetd_startup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware (possibly amongst many other releases) included both the private and public RSA keys. The remaining versions cited here redacted the private key, but left the public key unchanged. An attacker in possession of the leaked private key may, through a scripted exchange of UDP packets, instruct telnetd_startup to spawn an unauthenticated telnet shell as root, by means of which they can then obtain complete control of the device. A consequence of the limited availablility of firmware images for testing is that models and versions not listed here may share this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://www.tenable.com/security/research/tra-2022-01; https://www.tenable.com/security/research/tra-2022-01
CVE: CVE-2022-25218
Published: 2022-03-10
Description: The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219).
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://www.tenable.com/security/research/tra-2022-01; https://www.tenable.com/security/research/tra-2022-01
CVE: CVE-2022-25219
Published: 2022-03-10
Description: A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user to spawn a telnet service on the router, and to ensure that the telnet service persists upon reboot. By means of a crafted exchange of UDP packets, an unauthenticated attacker on the local network can leverage this null byte interaction error in such a way as to make those ephemeral passwords predictable (with 1-in-94 odds). Since the attacker must manipulate data processed by the OpenSSL function RSA_public_decrypt(), successful exploitation of this vulnerability depends on the use of an unpadded RSA cipher (CVE-2022-25218).
CVSS Score: 8.4 (HIGH)
References: https://www.tenable.com/security/research/tra-2022-01; https://www.tenable.com/security/research/tra-2022-01
CVE: CVE-2022-25225
Published: 2022-03-10
Description: Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation (PostgreSQL) by exploiting this issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/spinetta/; https://www.network-olympus.com/monitoring/; https://fluidattacks.com/advisories/spinetta/
CVE: CVE-2022-25230
Published: 2022-03-10
Description: Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25325.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU90121984/index.html; https://jvn.jp/en/vu/JVNVU90121984/index.html
CVE: CVE-2022-25234
Published: 2022-03-10
Description: Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-21124.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU90121984/index.html; https://jvn.jp/en/vu/JVNVU90121984/index.html
CVE: CVE-2022-25243
Published: 2022-03-10
Description: "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issuance/36600; https://security.gentoo.org/glsa/202207-01