« Volver al listado

CVE-2022-46309

Estado: ModificadaMedia (6.5)—

Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to access arbitrary system files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vitalsesp — Vitals ESP

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-46309",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-46309",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-10T16:27:48.173372Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Galaxy Software Services Corporation.",
          "product": "Vitals ESP",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.8",
              "versionType": "custom",
              "lessThanOrEqual": "6.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-03T03:15:10.717",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-6785-86407-1.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-6785-86407-1.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to access arbitrary system files."
    },
    {
      "lang": "es",
      "value": "La función de carga de Vitals ESP tiene una vulnerabilidad de Path Traversal. Un atacante remoto con privilegios de usuario general puede aprovechar esta vulnerabilidad para acceder a archivos arbitrarios del sistema."
    }
  ],
  "lastModified": "2026-06-17T05:11:28.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vitalsesp:vitals_esp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9C512F2-BFFC-4855-AF2E-21D60D4B0316",
              "versionEndIncluding": "6.2.0",
              "versionStartIncluding": "3.0.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}