by Kastro
Paper/Archive/CVE-2022-28719

CVE-2022-28719

Hammock Corporation AssetView — Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledg…

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.8.918 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code with the administrative privilege.

Affected

ProductAffectedFixed inSource
AssetViewprior to Ver.13.2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhammock.jp/assetview/info/220422.htmlrefjvn.jp/en/jp/JVN54857505/index.html