What is CVE-2022-41958?

CVE-2022-41958 is a high-severity vulnerability in 4ra1n Super-Xray, classified under Deserialization of Untrusted Data. CVSS score: 7.3/10. Published 2022-11-25.

How severe is CVE-2022-41958?

High severity. CVSS v3 base score is 7.3 out of 10.

Deserialization in 4ra1n Super-Xray

CVE-2022-41958

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue.

Vulnerability class: Insecure Deserialization

EPSS: 0.004 (35.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

4ra1n Super-xray — versions < 0.7
Super_xray_project Super_xray

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security-advisories@github.com (Exploit, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-41958?: CVE-2022-41958 is a high-severity vulnerability in 4ra1n Super-Xray, classified under Deserialization of Untrusted Data. CVSS score: 7.3/10. Published 2022-11-25.
How severe is CVE-2022-41958?: High severity. CVSS v3 base score is 7.3 out of 10.