CVE-2022-4272 : A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown

A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214760.

Published 2022-12-03 09:15:09

Updated 2023-04-26 12:15:10

Source VulDB

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Exploit prediction scoring system (EPSS) score for CVE-2022-4272

EPSS FAQ

0.93%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 83 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4272

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	2.8	3.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-4272

CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Assigned by: cna@vuldb.com (Primary)

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: cna@vuldb.com (Primary)

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Assigned by:

cna@vuldb.com (Primary)
nvd@nist.gov (Secondary)

References for CVE-2022-4272

https://github.com/FeMiner/wms/issues/14

WMS has a file upload code execution vulnerability · Issue #14 · FeMiner/wms · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://vuldb.com/?id.214760

CVE-2022-4272 | FeMiner wms unrestricted upload
Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2023/04/26/1

oss-security - Warpinator: Remote file deletion vulnerability (CVE-2023-29380)

CVEs referencing this url

Products affected by CVE-2022-4272

Vulnerability Details : CVE-2022-4272

Exploit prediction scoring system (EPSS) score for CVE-2022-4272

CVSS scores for CVE-2022-4272

CWE ids for CVE-2022-4272

References for CVE-2022-4272

Products affected by CVE-2022-4272