Paper/Archive/CVE-2022-38129

CVE-2022-38129

tenable — A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Senso…

EPSS 22%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 97.7.977 × 2019.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.

Affected

ProductAffectedFixed inSource

Keysight Technologies Sensor Management ServerKeysight Technologies Sensor Management Server v2.4.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADP8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftenable.com/security/research/tra-2022-28