CVE-2022-41763

{"id": "CVE-2022-41763", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-09-05T13:15:07.717", "references": [{"url": "https://www.gruppotim.it/it/footer/red-team.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS server, could inject code in the PING function. The privileges of the command executed depend on the user that runs the service."}, {"lang": "es", "value": "Se ha descubierto un problema en NOKIA AMS v9.7.05. Existe ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s del depurador de la variable \"ipAddress\". Un usuario remoto autenticado en el servidor AMS, podr\u00eda inyectar c\u00f3digo en la funci\u00f3n PING. Los privilegios del comando ejecutado depende del usuario que ejecuta el servicio. "}], "lastModified": "2023-09-08T13:14:00.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nokia:access_management_system:9.7.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E5A3717-77A8-476F-939F-530FACD43166"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}