9.8
CVE-2022-31691
- EPSS 18.84%
- Veröffentlicht 04.11.2022 19:15:10
- Zuletzt bearbeitet 02.05.2025 19:15:49
- Quelle security@vmware.com
- Teams Watchlist Login
- Unerledigt Login
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Bosh Editor Version >= 1.0.0 < 1.40.0
VMware ≫ Cloudfoundry Manifest Yml Support Version >= 1.0.0 < 1.40.0
VMware ≫ Concourse Ci Pipeline Editor Version >= 1.0.0 < 1.40.0
VMware ≫ Spring Boot Tools Version >= 1.0.0 < 1.40.0
VMware ≫ Spring Tools SwPlatformeclipse Version >= 4.0.0 < 4.16.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 18.84% | 0.951 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.