Vulnerability · Published Dec 1, 2022 · Assigned by VulDB
CVE-2022-4257C-DATA Web Management System GET Parameter jumpto.php argument injection
Medium 6.3
In plain English
A medium-severity security flaw in Web Management System from C-DATA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 43.9% (higher than 99% of all known vulnerabilities).
Official description
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| C-DATA | Web Management System | n/a |
Weakness: CWE-707 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L