CVE-2022-29937

{"id": "CVE-2022-29937", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-04-29T17:15:23.847", "references": [{"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-xw3r-mq8p-fjv5", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-xw3r-mq8p-fjv5", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product."}, {"lang": "es", "value": "La optimizaci\u00f3n de Oracle USU versiones anteriores a 5.17.5, permite a los usuarios autenticados de DataCollection conseguir el acceso al root del agente porque algunos comandos comunes del SO est\u00e1n bloqueados pero (por ejemplo) un comando del SO para la decodificaci\u00f3n de base64 no est\u00e1 bloqueado. NOTA: este no es un producto de Oracle Corporation"}], "lastModified": "2024-11-21T07:00:00.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:usu:oracle_optimization:20210817:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A08980E-A480-4A1C-8DC2-90F4098D27F2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}