« Volver al listado

CVE-2022-45183

Estado: ModificadaAlta (8.8)—

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ironmansoftware — Powershell Universal

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-45183",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-14T08:15:09.517",
  "references": [
    {
      "url": "https://blog.ironmansoftware.com/psu-2022-11-cve/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.powershelluniversal.com/changelog",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://ironmansoftware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blog.ironmansoftware.com/psu-2022-11-cve/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.powershelluniversal.com/changelog",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ironmansoftware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6."
    },
    {
      "lang": "es",
      "value": "La escalada de privilegios en el servidor web en Ironman Software PowerShell Universal 2.x y 3.x permite a un atacante con un token de aplicación válido recuperar otros tokens de aplicación por ID a través de una solicitud web HTTP. Las versiones parcheadas son 3.5.3, 3.4.7 y 2.12.6."
    }
  ],
  "lastModified": "2026-06-17T05:09:34.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ironmansoftware:powershell_universal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DA0AFEC-3493-42EB-91C7-A60AF04A83A8",
              "versionEndExcluding": "2.12.6",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ironmansoftware:powershell_universal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66B409D1-53ED-4C28-84A8-FACDA7C37D32",
              "versionEndExcluding": "3.4.7",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ironmansoftware:powershell_universal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "287F1703-01B6-4627-BF66-09202EFB76E2",
              "versionEndExcluding": "3.5.3",
              "versionStartIncluding": "3.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}