CVE-2022-4890 - OpenCVE

A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Predictapp Project	Predictapp

Configuration 1 [-]

cpe:2.3:a:predictapp_project:predictapp:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06	Patch
https://github.com/abhilash1985/PredictApp/pull/73	Patch
https://vuldb.com/?ctiid.218387	Permissions Required
https://vuldb.com/?id.218387	Permissions Required

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: VulDB

Published: 2023-01-16T12:58:03.551Z

Updated: 2023-10-20T14:28:20.851Z

Reserved: 2023-01-15T09:59:57.939Z

Link: CVE-2022-4890

JSON object: View

NVD Information

Status : Modified

Published: 2023-01-16T13:15:10.137

Modified: 2024-05-17T02:17:01.647

Link: CVE-2022-4890

JSON object: View

Redhat Information

No data.

CWE

CWE-502

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:predictapp_project:predictapp:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2D869E2-CF91-454B-845E-221EF4F92CF1", "versionEndExcluding": "2022-03-20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en abhilash1985 PredictApp y clasificada como cr\u00edtica. Este problema afecta un procesamiento desconocido del archivo config/initializers/new_framework_defaults_7_0.rb del componente Cookie Handler. La manipulaci\u00f3n conduce a la deserializaci\u00f3n. El ataque puede iniciarse de forma remota. El parche se llama b067372f3ee26fe1b657121f0f41883ff4461a06. Se recomienda aplicar un parche para solucionar este problema. El identificador asociado de esta vulnerabilidad es VDB-218387."}], "id": "CVE-2022-4890", "lastModified": "2024-05-17T02:17:01.647", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2023-01-16T13:15:10.137", "references": [{"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/abhilash1985/PredictApp/pull/73"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required"], "url": "https://vuldb.com/?ctiid.218387"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required"], "url": "https://vuldb.com/?id.218387"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "cna@vuldb.com", "type": "Secondary"}]}