Improper input validation in Nozomi Networks Cmc
CVE-2022-0550
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.009 (57.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Nozomi Networks Cmc — versions unspecified
- Nozomi Networks Guardian — versions unspecified
- Nozominetworks Cmc
- Nozominetworks Guardian
Weakness classification (CWE)
References
- prodsec@nozominetworks.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-0550?
- CVE-2022-0550 is a high-severity vulnerability in Nozomi Networks Cmc, classified under Improper Input Validation. CVSS score: 7.2/10. Published 2022-03-24.
- How severe is CVE-2022-0550?
- High severity. CVSS v3 base score is 7.2 out of 10.