CVE-2022-37398

A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and below as well as 4.1.0.RJD1 and below.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.asustor.com/security/security_advisory_detail?id=12	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:asustor:adm::::::::
	cpe:2.3:a:asustor:adm::::::::
	cpe:2.3:a:asustor:adm::::::::

History

11 Aug 2022, 17:59

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
References	~~(MISC) https://www.asustor.com/security/security_advisory_detail?id=12 -~~	(MISC) https://www.asustor.com/security/security_advisory_detail?id=12 - Vendor Advisory
First Time		Asustor Asustor adm
CWE		CWE-787
CPE		cpe:2.3:a:asustor:adm::::::::

05 Aug 2022, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-05 17:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-37398

Mitre link : CVE-2022-37398

CVE.ORG link : CVE-2022-37398

JSON object : View

Products Affected

asustor

adm

CWE

CWE-787

Out-of-bounds Write

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2022-37398", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@asustor.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 1.6}]}, "published": "2022-08-05T17:15:08.997", "references": [{"url": "https://www.asustor.com/security/security_advisory_detail?id=12", "tags": ["Vendor Advisory"], "source": "security@asustor.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "security@asustor.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and below as well as 4.1.0.RJD1 and below."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria dentro de ADM cuando usa WebDAV debido a una falta de validaci\u00f3n del tama\u00f1o de los datos. Un atacante puede explotar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario. Las versiones de ADM afectadas son: 3.5.9.RUE3 y anteriores, 4.0.5.RVI1 y anteriores, as\u00ed como 4.1.0.RJD1 y anteriores"}], "lastModified": "2022-08-11T17:59:53.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asustor:adm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "792CC2E3-7FC2-428E-AA55-92D093D97DB4", "versionEndIncluding": "3.5.9.rue3", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:asustor:adm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6521DF3B-B73C-4345-BE19-1C7F8B9E283C", "versionEndIncluding": "4.0.5.rvi1", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:asustor:adm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CD1D147-FB0B-4A4D-A483-FCD74D47DB27", "versionEndIncluding": "4.1.0.rjd1", "versionStartIncluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@asustor.com"}