CVE-2022-40238 — A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5

CVE-2022-40238

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5 PUBLISHED

Description (CNA)

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

Affected (CNA)

Vendor / product	Versions
CERT/CC / VINCE - The Vulnerability Information and Coordination Environment	affected 1.48.0 before 1.50.5

CWE

CWE-502

References

https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity

ADP enrichment

CVE

No English description supplied.

https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity

CISA-ADP

No English description supplied.

No references supplied.