« Volver al listado

CVE-2022-35220

Estado: ModificadaMedia (6.5)—

La función community discussion de Teamplus Pro, presenta una vulnerabilidad de "asignación de recursos sin límites o estrangulamiento". Un atacante remoto con privilegio de usuario general que publique un hilo con gran contenido puede causar que el dispositivo cliente receptor asigne demasiada memoria, conllevando a una terminación anormal de la aplicación Teamplus Pro de este cliente

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Teamplus — Team+ PRO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35220",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "TEAMPLUS TECHNOLOGY INC.",
          "product": "Teamplus Pro",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.011.6.0.1"
            }
          ],
          "platforms": [
            "Android"
          ]
        },
        {
          "vendor": "TEAMPLUS TECHNOLOGY INC.",
          "product": "Teamplus Pro",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.011.6.0.1"
            }
          ],
          "platforms": [
            "iOS"
          ]
        }
      ]
    }
  ],
  "published": "2022-08-02T16:15:10.597",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-6359-f5d1c-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-6359-f5d1c-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal termination of this client’s Teamplus Pro application."
    },
    {
      "lang": "es",
      "value": "La función community discussion de Teamplus Pro, presenta una vulnerabilidad de \"asignación de recursos sin límites o estrangulamiento\". Un atacante remoto con privilegio de usuario general que publique un hilo con gran contenido puede causar que el dispositivo cliente receptor asigne demasiada memoria, conllevando a una terminación anormal de la aplicación Teamplus Pro de este cliente"
    }
  ],
  "lastModified": "2026-06-17T04:51:34.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:teamplus:team\\+_pro:*:*:*:*:private_cloud:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "266BDB81-BE36-4A9D-BE19-9B96516B4E58",
              "versionEndIncluding": "3.011.6.0.1"
            },
            {
              "criteria": "cpe:2.3:a:teamplus:team\\+_pro:*:*:*:*:private_cloud:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E7BB0AB-B190-4997-9873-4E8C5FA60DED",
              "versionEndIncluding": "3.011.6.0.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}