CVE-2022-40238
Assigner: certcc
Published: 2022-10-26T15:15:45.247Z
State: PUBLISHED
title: A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
descriptions: value: A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.
affected: versions: version: 1.48.0
status: affected
lessThan: 1.50.5
versionType: custom
product: VINCE - The Vulnerability Information and Coordination Environment
vendor: CERT/CC
credits: value: Rapid7 researcher Marcus Chang discovered and reported this security vulnerability to CERT/CC 
problemTypes: descriptions: type: CWE
description: CWE-502: Deserialization of Untrusted Data
cweId: CWE-502
source: discovery: EXTERNAL
x_generator: engine: cveClient/1.0.13