CVE-2022-32222
mediumPriorität · verfolgen · 22EPSS 0.022 · 82. PerzentilDEEUUSEPSS · bewertet 2026-10-26
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenfesto_psirt
FactoryViews (non-Lite): Upgrade to FactoryViews 1.6.0. See the upgrade guide for information on how to upgrade. FactoryViews Lite: Upgrade to FactoryViews 1.7.0. See the upgrade guide for information on how to upgrade.
- BehobenSINEC INSsiemens_psirt
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INScisa_csaf_ot
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (45)
Betroffene Produkte und Versionsbereiche.
Advisories (8)
Hersteller- und Ökosystem-Meldungen dazu.
- FSA-202302Festo: Several vulnerabilities in FactoryViews2023-07-10csaf · festo_psirtDE
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications. FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities. At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.
- SSA-332410SSA-332410: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 12023-01-10csaf · siemens_psirtDE
Siemens has released a new version for SINEC INS that fixes multiple vulnerabilities that could allow an attacker to read and write arbitrary files from the file system of the affected component and to ultimately execute arbitrary code on the device. In addition, this version also contains fixes for multiple vulnerabilities in underlying third party components. Siemens has released an update for SINEC INS and recommends to update to the latest version.
- WID-SEC-W-2022-0621Node.js: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2022-07-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Programmcode auszuführen, um Konfigurationen zu manipulieren und um Sicherheitsmechanismen zu umgehen.
- WID-SEC-W-2022-1461IBM Spectrum Protect: Mehrere SchwachstellenDeutsch2022-09-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2023-0561Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-03-02csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- ICSA-23-017-03Siemens SINEC INS2023-01-10icsa · cisa_csaf_otUS
Siemens has released a new version for SINEC INS that fixes multiple vulnerabilities that could allow an attacker to read and write arbitrary files from the file system of the affected component and to ultimately execute arbitrary code on the device. In addition, this version also contains fixes for multiple vulnerabilities in underlying third party components. Siemens has released an update for SINEC INS and recommends to update to the latest version.
- BIT-node-2022-322222024-03-06vendor · osvUS
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
- BIT-node-min-2022-322222024-12-16vendor · osvUS
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202207-682cnnvd
- EUVD-2022-53423enisa_euvd
- GHSA-fxfc-w6xq-5pp8enisa_euvd
- BIT-node-2022-32222osv
- BIT-node-min-2022-32222osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (9)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2022-32222cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdfcnnvd
- https://cxsecurity.com/cveshow/CVE-2022-32222/cnnvd
- https://hackerone.com/reports/1695596cnnvd
- https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/cnnvd
- https://security.netapp.com/advisory/ntap-20220915-0001/cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022071338cnnvd
- https://hackerone.com/reports/1695596enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan