« Volver al listado

CVE-2022-28874

Estado: ModificadaAlta (7.5)—

Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause memory corruption and heap buffer overflow which eventually can crash the scanning engine. The exploit can be triggered remotely by an attacker.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

F-secure — AtlantF-secure — Elements Endpoint ProtectionF-secure — Linux SecurityWithsecure — Cloud Protection FOR SalesforceWithsecure — Elements Collaboration Protection

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-28874",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-notifications-us@f-secure.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve-notifications-us@f-secure.com",
      "affectedData": [
        {
          "vendor": "F-Secure",
          "product": "F-Secure endpoint protection products for Windows and Mac. F-Secure Linux Security (32-bit).  F-Secure Linux Security 64.  F-Secure Atlant. WithSecure Cloud Protection for Salesforce & WithSecure Collaboration Protection",
          "versions": [
            {
              "status": "affected",
              "version": "All Version"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-23T11:16:10.827",
  "references": [
    {
      "url": "https://www.f-secure.com/en/home/support/security-advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve-notifications-us@f-secure.com"
    },
    {
      "url": "https://www.withsecure.com/en/support/security-advisories",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-notifications-us@f-secure.com"
    },
    {
      "url": "https://www.f-secure.com/en/home/support/security-advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.withsecure.com/en/support/security-advisories",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause memory corruption and heap buffer overflow which eventually can crash the scanning engine. The exploit can be triggered remotely by an attacker."
    },
    {
      "lang": "es",
      "value": "Se han detectado múltiples vulnerabilidades de Denegación de Servicio en F-Secure Atlant y en determinados productos WithSecure mientras son escaneados archivos PE32-bit fuzzed que causan corrupción de memoria y desbordamiento de búfer de la pila, lo que eventualmente puede bloquear el motor de escaneo. La explotación puede ser desencadenada remotamente por un atacante"
    }
  ],
  "lastModified": "2026-06-17T04:39:15.627",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f-secure:atlant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C97DC3C-1B63-4B57-8C62-ACD77D0A3E71"
            },
            {
              "criteria": "cpe:2.3:a:f-secure:elements_endpoint_protection:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DFC1F94-8A8B-42E2-887B-EE8FB3C9130D"
            },
            {
              "criteria": "cpe:2.3:a:f-secure:linux_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EBE4C11-5678-420C-ACC1-B92B095C6D1B"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:withsecure:cloud_protection_for_salesforce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAF1A3D4-671B-4260-A037-1792B4BED229"
            },
            {
              "criteria": "cpe:2.3:a:withsecure:elements_collaboration_protection:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64BDA5A1-28E5-4706-93E0-6651A2E1FFB6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-notifications-us@f-secure.com"
}