2022年04月の脆弱性

誤りがあった場合はTwitterに報告をお願いします。-> Twitter《Har-sia》

今月話題になった脆弱性まとめ

CVE-2020-1225

Description from NVD

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1226.

Information Acquisition Date:2022/05/01

CVSS 2.0: 9.3 HIGH CVSS 3.x: 8.8 HIGH

Highest Score:56 （2022/04/20）

脆弱性情報：Har-sia CVE-2020-1225

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2021-31805

Description from NVD

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Information Acquisition Date:2022/05/01

CVSS 2.0: 7.5 HIGH CVSS 3.x: 9.8 CRITICAL

This vulnerability may involve a PoC.

Highest Score:43 （2022/04/13）

脆弱性情報：Har-sia CVE-2021-31805

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-1162

Description from NVD

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

Information Acquisition Date:2022/05/01

CVSS 2.0: 7.5 HIGH CVSS 3.x: 9.8 CRITICAL

Highest Score:61 （2022/04/02）

脆弱性情報：Har-sia CVE-2022-1162

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-1364

Highest Score:55 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-1364

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-21449

Description from NVD

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Information Acquisition Date:2022/05/01

CVSS 2.0: 5.0 MEDIUM CVSS 3.x: 7.5 HIGH

This vulnerability may involve a PoC.

Description from Forti

Security Vulnerability CVE-2022-21449 in Oracle JRE

Information Acquisition Date:2022/04/30

Affected Products

Impact

Recommended Actions

References

Highest Score:177 （2022/04/21）

脆弱性情報：Har-sia CVE-2022-21449

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-22675

Highest Score:62 （2022/04/01）

脆弱性情報：Har-sia CVE-2022-22675

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-22954

Description from NVD

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Information Acquisition Date:2022/05/01

CVSS 2.0: 10.0 HIGH CVSS 3.x: 9.8 CRITICAL

This vulnerability may involve a PoC.

Highest Score:133 （2022/04/14）

脆弱性情報：Har-sia CVE-2022-22954

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-22963

Description from NVD

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Information Acquisition Date:2022/05/01

CVSS 2.0: 7.5 HIGH CVSS 3.x: 9.8 CRITICAL

This vulnerability may involve a PoC.

Highest Score:239 （2022/03/31）

脆弱性情報：Har-sia CVE-2022-22963

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-22965

Description from NVD

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Information Acquisition Date:2022/05/01

CVSS 2.0: 7.5 HIGH CVSS 3.x: 9.8 CRITICAL

This vulnerability may involve a PoC.

Highest Score:468 （2022/04/01）

脆弱性情報：Har-sia CVE-2022-22965

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-24521

Description from NVD

Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24481.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:65 （2022/04/13）

脆弱性情報：Har-sia CVE-2022-24521

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-24765

Description from NVD

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.

Information Acquisition Date:2022/05/01

CVSS 2.0: 6.9 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:35 （2022/04/13）

脆弱性情報：Har-sia CVE-2022-24765

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26786

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:37 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26786

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26787

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:37 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26787

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26789

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:37 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26789

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26790

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:37 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26790

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26791

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:37 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26791

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26792

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:38 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26792

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26793

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:37 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26793

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26794

Description from NVD

Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

Information Acquisition Date:2022/05/01

CVSS 2.0: 4.6 MEDIUM CVSS 3.x: 7.8 HIGH

Highest Score:36 （2022/04/16）

脆弱性情報：Har-sia CVE-2022-26794

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-26809

Description from NVD

Remote Procedure Call Runtime Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24492, CVE-2022-24528.

Information Acquisition Date:2022/05/01

CVSS 2.0: 10.0 HIGH CVSS 3.x: 9.8 CRITICAL

Highest Score:213 （2022/04/15）

脆弱性情報：Har-sia CVE-2022-26809

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-29072

Description from NVD

** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur.

Information Acquisition Date:2022/05/01

CVSS 2.0: 7.2 HIGH CVSS 3.x: 7.8 HIGH

This vulnerability may involve a PoC.

Highest Score:64 （2022/04/18）

脆弱性情報：Har-sia CVE-2022-29072

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-29464

Description from NVD

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.

Information Acquisition Date:2022/05/01

CVSS 2.0: 10.0 HIGH CVSS 3.x: 9.8 CRITICAL

Highest Score:56 （2022/04/23）

脆弱性情報：Har-sia CVE-2022-29464

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-29799

Highest Score:63 （2022/04/27）

脆弱性情報：Har-sia CVE-2022-29799

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

CVE-2022-29800

Highest Score:62 （2022/04/27）

脆弱性情報：Har-sia CVE-2022-29800

管理者コメント

（自動翻訳）脆弱性まとめる際にここに自動翻訳を挿入します。次月までお待ちください。（自動翻訳ここまで）

###---###

参考URL：

計24件