CVE-2022-47924: csaf-validator-lib before 0.1.0 (exclusive), 0.0.0 to before 0.1.0

Affected technology

csaf-validator-lib · before 0.1.0 (exclusive)
csaf-validator-lib project

csaf-validator-lib · 0.0.0 to before 0.1.0
Secvisogram

Description’s affected range: versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation

Component: Not specified by the source
Function: of

Attack conditions (Vendor/CNA, CVSS 3.1): Local · High privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · High privileges required · User interaction required

What an attacker can do

An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality, integrity and availability impact as high.