Vulnerability in Nagvis
CVE-2022-3979
A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
EPSS: 0.010 (59.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Nagvis
- N/a Nagvis — versions 1.9.0, 1.9.1, 1.9.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (Permissions Required, technical-description, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Release Notes, patch)
- cna@vuldb.com (related, Exploit)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2022-3979?
- CVE-2022-3979 is a medium-severity vulnerability in Nagvis, classified under Incorrect Type Conversion or Cast. CVSS score: 5.6/10. Published 2022-11-13.
- How severe is CVE-2022-3979?
- Medium severity. CVSS v3 base score is 5.6 out of 10.
- Is CVE-2022-3979 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.