CVE-2022-36436

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-36436
OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ Exploit Patch
https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b Patch
https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 Release Notes
https://pypi.org/project/VNCAuthProxy/ Product
https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ Exploit Patch
https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b Patch
https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 Release Notes
https://pypi.org/project/VNCAuthProxy/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:osuosl:twisted_vnc_authentication_proxy:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:13

Type Values Removed Values Added
References () https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ - Exploit, Patch () https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ - Exploit, Patch
References () https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b - Patch () https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b - Patch
References () https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 - Release Notes () https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 - Release Notes
References () https://pypi.org/project/VNCAuthProxy/ - Product () https://pypi.org/project/VNCAuthProxy/ - Product

13 Feb 2024, 17:21

Type Values Removed Values Added
CWE NVD-CWE-Other CWE-287
References () https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ - Exploit, Patch, Third Party Advisory () https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ - Exploit, Patch
References () https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b - Patch, Third Party Advisory () https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b - Patch
References () https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 - Release Notes, Third Party Advisory () https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 - Release Notes
References () https://pypi.org/project/VNCAuthProxy/ - Product, Third Party Advisory () https://pypi.org/project/VNCAuthProxy/ - Product

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-287 NVD-CWE-Other

16 Sep 2022, 03:00

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References (MISC) https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ - (MISC) https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b - (MISC) https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b - Patch, Third Party Advisory
References (MISC) https://pypi.org/project/VNCAuthProxy/ - (MISC) https://pypi.org/project/VNCAuthProxy/ - Product, Third Party Advisory
References (MISC) https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 - (MISC) https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1 - Release Notes, Third Party Advisory
CWE CWE-287
CPE cpe:2.3:a:osuosl:twisted_vnc_authentication_proxy:*:*:*:*:*:*:*:*

14 Sep 2022, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-09-14 11:15

Updated : 2024-11-21 07:13

NVD link : CVE-2022-36436

Mitre link : CVE-2022-36436

CVE.ORG link : CVE-2022-36436

JSON object : View

Products Affected

osuosl

  • twisted_vnc_authentication_proxy
CWE
CWE-287

Improper Authentication