NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
History

Wed, 18 Dec 2024 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-01-14T17:13:57

Updated: 2024-12-21T04:56:13.766Z

Reserved: 2022-01-14T00:00:00

Link: CVE-2022-23227

cve-icon Vulnrichment

Updated: 2024-08-03T03:36:20.190Z

cve-icon NVD

Status : Modified

Published: 2022-01-14T18:15:10.303

Modified: 2024-12-19T02:00:02.193

Link: CVE-2022-23227

cve-icon Redhat

No data.