CVE-2022-41675

Published Nov 29, 2022

Last updated 2 years ago

Overview

Description: A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system operation or disrupt service on the user side.
Source: twcert@cert.org.tw
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8
Impact score: 5.9
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-1236
twcert@cert.org.tw: CWE-1236

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:raidenmaild:raidenmaild:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2FC06351-BF11-4B17-91D3-32D0041D5851",
            "versionEndExcluding": "4.7.4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References