CVE-2022-34668

Published Aug 29, 2022

Last updated 2 years ago

CVSS critical 9.8

Overview

Description: NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Source: psirt@nvidia.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-502
psirt@nvidia.com: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nvidia:nvflare:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "743CE31A-EC75-4F38-97E2-EB3DAC23F8E6",
            "versionEndExcluding": "2.1.4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References