CVE-2022-41835 - OpenCVE

In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
F5	F5os-a F5os-c

Configuration 1 [-]

OR	cpe:2.3:o:f5:f5os-a::::::::
	cpe:2.3:o:f5:f5os-c::::::::

No data.

References

Link	Providers
https://support.f5.com/csp/article/K33484483

History

No history.

MITRE

Status: PUBLISHED

Assigner: f5

Published: 2022-10-19T21:24:53.599766Z

Updated: 2024-09-16T21:08:00.681Z

Reserved: 2022-09-30T00:00:00

Link: CVE-2022-41835

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-10-19T22:15:13.470

Modified: 2022-10-24T15:51:49.297

Link: CVE-2022-41835

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:*", "matchCriteriaId": "C88AF594-4D48-4A55-BE21-60391E77AAE7", "versionEndExcluding": "1.1.0", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:f5:f5os-c:*:*:*:*:*:*:*:*", "matchCriteriaId": "93D6CFC6-2131-4113-9E30-8400EBA5AA77", "versionEndExcluding": "1.5.0", "versionStartExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller."}, {"lang": "es", "value": "En F5OS-A versiones 1.x y anteriores a 1.1.0 y en versi\u00f3n 1.x de F5OS-C anteriores a 1.5.0, un exceso de permisos de archivos en F5OS permite a un atacante local autenticado ejecutar un conjunto limitado de comandos en un contenedor y afectar al controlador de F5OS"}], "id": "CVE-2022-41835", "lastModified": "2022-10-24T15:51:49.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 4.7, "source": "f5sirt@f5.com", "type": "Secondary"}]}, "published": "2022-10-19T22:15:13.470", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K33484483"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "f5sirt@f5.com", "type": "Primary"}]}