Exploit

CVE-2022-4864

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

Published: Dec 30, 2022 / Updated: 23mo ago

GitHub Security Advisory: GHSA-3v7m-2jrh-vc93 Release Date: 2022-12-31 Update Date: 2023-01-03 Severity: Moderate CVE-2022-4864 Package Information Package: froxlor/froxlor Affected Versions: >= 2.0.0-beta0, Patched Versions: 2.0.0-beta1 Description Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. References https://nvd.nist.gov/vuln/detail/CVE-2022-4864 Froxlor/Froxlor@f2485ec https://huntr.dev/bounties/b7140709-8f84-4f19-9463-78669fa2175b

Original release date: January 9, 2023 Last revised: January 10, 2023 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info synology -- vpn_plus_server Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors. 2023-01-03 10 CVE-2022-43931 MISC printer_project -- printer A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The name of the patch is 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.

Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. CVE-2022-4864 originally published on CyberSecurityBoard

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.

Original release date: January 9, 2023 Last revised: January 10, 2023 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info synology -- vpn_plus_server Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors. 2023-01-03 10 CVE-2022-43931 MISC printer_project -- printer A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The name of the patch is 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.

GitHub Security Advisory: GHSA-3v7m-2jrh-vc93 Release Date: 2022-12-31 Update Date: 2023-01-03 Severity: Moderate CVE-2022-4864 Package Information Package: froxlor/froxlor Affected Versions: >= 2.0.0-beta0, Patched Versions: 2.0.0-beta1 Description Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. References https://nvd.nist.gov/vuln/detail/CVE-2022-4864 Froxlor/Froxlor@f2485ec https://huntr.dev/bounties/b7140709-8f84-4f19-9463-78669fa2175b

A vulnerability has been found in froxlor up to 1.x and classified as critical . This vulnerability affects unknown code. The manipulation leads to argument injection. This vulnerability was named CVE-2022-4864 . Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.