CVE-2022-40238

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

Score

CVSS 3.1 8.8 High

Status

Modified - cret@cert.org

Published

2022-10-26

Last modified

2025-05-07

Weaknesses

CWE-502

Affected products

• Vince (Cert)
• Vince - The Vulnerability Information And Coordination Environment (Certcc)

References

• https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity