CVE-2022-31795
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
Se ha detectado un problema en los dispositivos Fujitsu ETERNUS CentricStor CS8000 (Control Center) versiones anteriores a 8.1A SP02 P04. La vulnerabilidad reside en la función grel_finfo en el archivo grel.php. Un atacante puede influir en los parámetros username (user), password (pw) y file-name (file) e inyectar caracteres especiales como punto y coma, puntos suspensivos o secuencias de sustitución de comandos para forzar a la aplicación a ejecutar comandos arbitrarios
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-29 CVE Reserved
- 2022-06-20 CVE Published
- 2024-02-23 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://cwe.mitre.org/data/definitions/78.html | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://research.nccgroup.com/2022/05/27/technical-advisory-fujitsu-centricstor-control-center-v8-1-unauthenticated-command-injection | 2024-08-03 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Fujitsu Search vendor "Fujitsu" | Eternus Cs8000 Firmware Search vendor "Fujitsu" for product "Eternus Cs8000 Firmware" | < 8.1 Search vendor "Fujitsu" for product "Eternus Cs8000 Firmware" and version " < 8.1" | - |
Affected
| in | Fujitsu Search vendor "Fujitsu" | Eternus Cs8000 Search vendor "Fujitsu" for product "Eternus Cs8000" | - | - |
Safe
|
Fujitsu Search vendor "Fujitsu" | Eternus Cs8000 Firmware Search vendor "Fujitsu" for product "Eternus Cs8000 Firmware" | 8.1 Search vendor "Fujitsu" for product "Eternus Cs8000 Firmware" and version "8.1" | - |
Affected
| in | Fujitsu Search vendor "Fujitsu" | Eternus Cs8000 Search vendor "Fujitsu" for product "Eternus Cs8000" | - | - |
Safe
|