Sign-up

ID

VAR-202205-0348


CVE

CVE-2022-27662


TITLE

F5 Traffix SDC  Improper Disablement of Special Elements Used in Template Engine in

Trust: 0.8

sources: JVNDB: JVNDB-2022-010245

DESCRIPTION

On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context of the server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. F5 Traffix SDC contains an improper disabling of special elements used by the template engine.Information may be obtained and information may be tampered with. F5 Traffix Signaling Delivery Controller (F5 Traffix SDC) is a signaling delivery controller of F5 Company in the United States. Designed to provide operators with complete connectivity, unlimited scalability and total control

Trust: 2.34

sources: NVD: CVE-2022-27662 // JVNDB: JVNDB-2022-010245 // CNVD: CNVD-2022-74961 // VULHUB: VHN-419884 // VULMON: CVE-2022-27662

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-74961

AFFECTED PRODUCTS

vendor:f5model:traffix signaling delivery controllerscope:eqversion:5.2.0

Trust: 1.0

vendor:f5model:traffix signaling delivery controllerscope:eqversion:5.1.0

Trust: 1.0

vendor:f5model:traffix sdcscope:ltversion:5.2.x

Trust: 0.8

vendor:f5model:traffix sdcscope:ltversion:5.1.x

Trust: 0.8

vendor:f5model:traffix sdcscope:eqversion:5.2.2

Trust: 0.8

vendor:f5model:traffix sdcscope:eqversion: -

Trust: 0.8

vendor:f5model:traffix sdcscope:eqversion:5.1.35

Trust: 0.8

vendor:f5model:traffix sdcscope:eqversion:5.1.0

Trust: 0.6

vendor:f5model:traffix sdcscope:eqversion:5.2.0

Trust: 0.6

sources: CNVD: CNVD-2022-74961 // JVNDB: JVNDB-2022-010245 // NVD: CVE-2022-27662

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-27662
value: MEDIUM

Trust: 1.0

f5sirt@f5.com: CVE-2022-27662
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-27662
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-74961
value: LOW

Trust: 0.6

CNNVD: CNNVD-202205-2481
value: MEDIUM

Trust: 0.6

VULHUB: VHN-419884
value: LOW

Trust: 0.1

VULMON: CVE-2022-27662
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2022-27662
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-74961
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-419884
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-27662
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.7
impactScore: 2.7
version: 3.1

Trust: 2.0

OTHER: JVNDB-2022-010245
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-74961 // VULHUB: VHN-419884 // VULMON: CVE-2022-27662 // JVNDB: JVNDB-2022-010245 // CNNVD: CNNVD-202205-2481 // NVD: CVE-2022-27662 // NVD: CVE-2022-27662

PROBLEMTYPE DATA

problemtype:CWE-1336

Trust: 1.0

problemtype:Improper disabling of special elements used by the template engine (CWE-1336) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-010245 // NVD: CVE-2022-27662

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-2481

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202205-2481

PATCH

title:K24248011url:https://my.f5.com/manage/s/article/K24248011

Trust: 0.8

title:Patch for F5 Traffix SDC Cross-Site Template Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/360246

Trust: 0.6

title:F5 Traffix SDC Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=192844

Trust: 0.6

sources: CNVD: CNVD-2022-74961 // JVNDB: JVNDB-2022-010245 // CNNVD: CNNVD-202205-2481

EXTERNAL IDS

db:NVDid:CVE-2022-27662

Trust: 4.0

db:JVNDBid:JVNDB-2022-010245

Trust: 0.8

db:CNVDid:CNVD-2022-74961

Trust: 0.7

db:CNNVDid:CNNVD-202205-2481

Trust: 0.6

db:VULHUBid:VHN-419884

Trust: 0.1

db:VULMONid:CVE-2022-27662

Trust: 0.1

sources: CNVD: CNVD-2022-74961 // VULHUB: VHN-419884 // VULMON: CVE-2022-27662 // JVNDB: JVNDB-2022-010245 // CNNVD: CNNVD-202205-2481 // NVD: CVE-2022-27662

REFERENCES

url:https://support.f5.com/csp/article/k24248011

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-27662

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-27662/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/1336.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-74961 // VULHUB: VHN-419884 // VULMON: CVE-2022-27662 // JVNDB: JVNDB-2022-010245 // CNNVD: CNNVD-202205-2481 // NVD: CVE-2022-27662

SOURCES

db:CNVDid:CNVD-2022-74961
db:VULHUBid:VHN-419884
db:VULMONid:CVE-2022-27662
db:JVNDBid:JVNDB-2022-010245
db:CNNVDid:CNNVD-202205-2481
db:NVDid:CVE-2022-27662

LAST UPDATE DATE

2024-11-23T23:10:54.062000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-74961date:2022-11-08T00:00:00
db:VULHUBid:VHN-419884date:2022-05-13T00:00:00
db:VULMONid:CVE-2022-27662date:2022-05-13T00:00:00
db:JVNDBid:JVNDB-2022-010245date:2023-08-14T05:43:00
db:CNNVDid:CNNVD-202205-2481date:2022-05-16T00:00:00
db:NVDid:CVE-2022-27662date:2024-11-21T06:56:07.580

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-74961date:2022-11-08T00:00:00
db:VULHUBid:VHN-419884date:2022-05-05T00:00:00
db:VULMONid:CVE-2022-27662date:2022-05-05T00:00:00
db:JVNDBid:JVNDB-2022-010245date:2023-08-14T00:00:00
db:CNNVDid:CNNVD-202205-2481date:2022-05-05T00:00:00
db:NVDid:CVE-2022-27662date:2022-05-05T17:15:13.467