CVE-2022-41763: nokia access_management_system Code Injection

Vulnerability summary

CVE-2022-41763 is a high (CVSS 8.8) Code Injection vulnerability in nokia access_management_system. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2023
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS server, could inject code in the PING function. The privileges of the command executed depend on the user that runs the service.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.