Vulnerability · Published Aug 10, 2022 · Assigned by tenable
CVE-2022-38129
High 8.1
In plain English
A high-severity security flaw in Keysight Technologies Sensor Management Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 22.0% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)22.0%top 2.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Keysight Technologies Sensor Management Server | Keysight Technologies Sensor Management Server v2.4.0 |
Weakness: CWE-24 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://www.tenable.com/security/research/tra-2022-28 x_refsource_MISC