Vulnerability · Published Aug 16, 2022 · Assigned by Bitdefender
CVE-2022-1399Remote code execution in scheduled tasks component
Critical 9.1
In plain English
A critical-severity argument injection in CMDB from Device42. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.0%top 38.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H