« Volver al listado

CVE-2022-29972

Estado: ModificadaAlta (7.8)—

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Insightsoftware — Magnitude Simba Amazon Redshift Odbc Driver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-29972",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-09T18:15:08.700",
  "references": [
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.magnitude.com/products/data-connectivity",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.magnitude.com/products/data-connectivity",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de argumentos en el componente de autenticación basado en el navegador del controlador ODBC de Magnitude Simba Amazon Redshift (versiones 1.4.14 hasta 1.4.21.1001 y versiones 1.4.22 hasta 1.4.x anteriores a 1.4.52) puede permitir que un usuario local ejecute código arbitrario"
    }
  ],
  "lastModified": "2026-06-17T04:41:03.767",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insightsoftware:magnitude_simba_amazon_redshift_odbc_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97B6ABB6-A18D-410F-BEB1-E30235E43672",
              "versionEndIncluding": "1.4.21.1001",
              "versionStartIncluding": "1.4.11"
            },
            {
              "criteria": "cpe:2.3:a:insightsoftware:magnitude_simba_amazon_redshift_odbc_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5AF1665-848B-49AA-A6E4-6FCC6B696720",
              "versionEndExcluding": "1.4.52",
              "versionStartIncluding": "1.4.22"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}