« Volver al listado

CVE-2022-22689

Estado: ModificadaAlta (8.8)—

CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Broadcom — CA Harvest Software Change Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22689",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vuln@ca.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "CA Harvest Software Change Manager",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.3, 13.0.4, 14.0.0, 14.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-04T23:15:13.017",
  "references": [
    {
      "url": "https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "vuln@ca.com"
    },
    {
      "url": "https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vuln@ca.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands."
    },
    {
      "lang": "es",
      "value": "CA Harvest Software Change Manager versiones 13.0.3, 13.0.4, 14.0.0 y 14.0.1, contienen una vulnerabilidad en la funcionalidad de exportación de CSV, debido a una comprobación de entrada insuficiente, que puede permitir a un usuario con privilegios ejecutar potencialmente código o comandos arbitrarios"
    }
  ],
  "lastModified": "2026-06-17T04:28:49.213",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:ca_harvest_software_change_manager:13.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E37E5E4-14DE-4D7E-B567-FFF45ED8FE55"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:ca_harvest_software_change_manager:13.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A272EF3D-691D-43D2-BFCD-1D88CD7D220C"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:ca_harvest_software_change_manager:14.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5CF0DAE-8A1B-4A02-8C77-613BFC8F8154"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:ca_harvest_software_change_manager:14.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACEC9B1A-925A-44A5-A323-433369A5C260"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vuln@ca.com"
}