CVE-2022-34965 - Vulnerability Details - OpenCVE

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.02221.

Key SSVC decision points have not yet been added.

Vendors	Products
Openteknik	Open Source Social Network

Configuration 1 [-]

cpe:2.3:a:openteknik:open_source_social_network:6.3:*:*:*:lts:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-37867	OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3
https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880
https://www.opensource-socialnetwork.org/
https://www.openteknik.com/contact?channel=ossn

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-07-25T00:00:00

Updated: 2024-08-03T09:22:10.880Z

Reserved: 2022-07-04T00:00:00

Link: CVE-2022-34965

Vulnrichment

Updated: 2024-08-03T09:22:10.880Z

NVD

Status : Modified

Published: 2022-07-25T17:15:08.220

Modified: 2024-11-21T07:10:29.460

Link: CVE-2022-34965

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-34965", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-03T09:22:10.880Z", "dateReserved": "2022-07-04T00:00:00", "datePublished": "2022-07-25T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-03T20:57:49.859855"}, "descriptions": [{"lang": "en", "value": "OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files."}], "tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.opensource-socialnetwork.org/"}, {"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3"}, {"url": "https://www.openteknik.com/contact?channel=ossn"}, {"url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "affected": [{"vendor": "openteknik", "product": "open_source_social_network", "cpes": ["cpe:2.3:a:openteknik:open_source_social_network:6.3:*:*:*:lts:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.3", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-16T20:35:13.561540Z", "id": "CVE-2022-34965", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T20:37:55.755Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:22:10.880Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.opensource-socialnetwork.org/", "tags": ["x_transferred"]}, {"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3", "tags": ["x_transferred"]}, {"url": "https://www.openteknik.com/contact?channel=ossn", "tags": ["x_transferred"]}, {"url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.opensource-socialnetwork.org/", "tags": ["x_transferred"]}, {"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3", "tags": ["x_transferred"]}, {"url": "https://www.openteknik.com/contact?channel=ossn", "tags": ["x_transferred"]}, {"url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:22:10.880Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-34965", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-16T20:35:13.561540Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:openteknik:open_source_social_network:6.3:*:*:*:lts:*:*:*"], "vendor": "openteknik", "product": "open_source_social_network", "versions": [{"status": "affected", "version": "6.3"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T20:37:51.409Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.opensource-socialnetwork.org/"}, {"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3"}, {"url": "https://www.openteknik.com/contact?channel=ossn"}, {"url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880"}], "descriptions": [{"lang": "en", "value": "OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-03T20:57:49.859855"}}}, "cveMetadata": {"cveId": "CVE-2022-34965", "state": "PUBLISHED", "dateUpdated": "2024-08-03T09:22:10.880Z", "dateReserved": "2022-07-04T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2022-07-25T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openteknik:open_source_social_network:6.3:*:*:*:lts:*:*:*", "matchCriteriaId": "AD675B1D-9111-4816-9022-3BA789A27D32", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files."}, {"lang": "es", "value": "Se ha detectado que OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK versi\u00f3n v6.3 LTS, contiene una vulnerabilidad de carga de archivos arbitraria por medio del componente /ossn/administrator/com_installer. Esta vulnerabilidad permite a atacantes ejecutar c\u00f3digo arbitrario por medio de un archivo PHP dise\u00f1ado"}], "id": "CVE-2022-34965", "lastModified": "2024-11-21T07:10:29.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-07-25T17:15:08.220", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.opensource-socialnetwork.org/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.openteknik.com/contact?channel=ossn"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://grimthereaperteam.medium.com/cve-2022-34965-open-source-social-network-6-3-3f61db82880"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.opensource-socialnetwork.org/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.openteknik.com/contact?channel=ossn"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}