Vulnerability · Published Aug 2, 2022 · Assigned by twcert
CVE-2022-35223EasyUse MailHunter Ultimate - Deserialization of Untrusted Data
Critical 9.8
In plain English
A critical-severity unsafe deserialization in MailHunter Ultimate from EasyUse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.7%top 23.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EasyUse | MailHunter Ultimate | unspecified – through 2020 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-6365-b056c-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/a381467e-74ff-4a8c-a4d3-fc86720f5400 x_refsource_MISC