CVE-2022-42971

Published Feb 1, 2023

Last updated 2 years ago

CVSS critical 9.8

Overview

Description: A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Source: cybersecurity@se.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-434
cybersecurity@se.com: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:schneider-electric:apc_easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B8FBFEF-F5DC-4F71-B990-B74C68733741",
            "versionEndExcluding": "2.5-ga-01-22320"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:-:*",
            "vulnerable": false,
            "matchCriteriaId": "647F2145-B063-43EA-8045-32D3B4D893F6"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:schneider-electric:easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C587FB36-A05E-4925-B643-D52EE7AEF952",
            "versionEndExcluding": "2.5-gs-01-22320"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:-:*",
            "vulnerable": false,
            "matchCriteriaId": "647F2145-B063-43EA-8045-32D3B4D893F6"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:schneider-electric:apc_easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F73E8580-C9EF-4F21-A5D0-468D85BDDEE1",
            "versionEndExcluding": "2.5-ga"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:-:*",
            "vulnerable": false,
            "matchCriteriaId": "E31E09C7-9F07-4FAE-8C38-16E75BC8A576"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:-:*",
            "vulnerable": false,
            "matchCriteriaId": "647F2145-B063-43EA-8045-32D3B4D893F6"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "E33796DB-4523-4F04-B564-ADF030553D51"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:schneider-electric:easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D2CC95E9-44AE-4809-83DE-4AFDA682305B",
            "versionEndExcluding": "2.5-gs"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:-:*",
            "vulnerable": false,
            "matchCriteriaId": "E31E09C7-9F07-4FAE-8C38-16E75BC8A576"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:-:*",
            "vulnerable": false,
            "matchCriteriaId": "647F2145-B063-43EA-8045-32D3B4D893F6"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "E33796DB-4523-4F04-B564-ADF030553D51"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References