« Volver al listado

CVE-2022-35503

Estado: AplazadaAlta (7.5)—

Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function (VNF) descriptor. An attacker may be able execute code to change the normal execution of the OSM components, retrieve confidential information, or gain access other parts of a Telco Operator infrastructure other than OSM itself.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Open Source Mano — OSMAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35503",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-35503",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-22T17:39:38.066022Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:osm:N2VC:7:*:*:*:*:*:*:*"
          ],
          "vendor": "osm",
          "product": "N2VC",
          "versions": [
            {
              "status": "affected",
              "version": "7",
              "versionType": "custom",
              "lessThanOrEqual": "12"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-22T15:15:46.590",
  "references": [
    {
      "url": "https://osm.etsi.org/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://osm.etsi.org/news-events/blog/83-cve-2022-35503-disclosure",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://osm.etsi.org/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://osm.etsi.org/news-events/blog/83-cve-2022-35503-disclosure",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        },
        {
          "lang": "en",
          "value": "CWE-286"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function (VNF) descriptor. An attacker may be able execute code to change the normal execution of the OSM components, retrieve confidential information, or gain access other parts of a Telco Operator infrastructure other than OSM itself."
    },
    {
      "lang": "es",
      "value": "La verificación inadecuada de una entrada de usuario en Open Source MANO v7-v12 permite que un atacante autenticado ejecute código arbitrario dentro del contenedor del módulo LCM a través de un descriptor de función de red virtual (VNF). Un atacante puede ejecutar código para cambiar la ejecución normal de los componentes de OSM, recuperar información confidencial u obtener acceso a otras partes de la infraestructura de un operador de telecomunicaciones distintas del propio OSM."
    }
  ],
  "lastModified": "2026-06-17T04:51:53.680",
  "sourceIdentifier": "cve@mitre.org"
}