Vulnerability-Lookup

CNVD-2022-67143

Vulnerability from cnvd - Published: 2022-09-27

Title

HPE Version Control Repository Manager权限提升漏洞

Description

HPE Version Control Repository Manager是美国慧与科技（HPE）公司的一款版本控制存储库管理器。 HPE Version Control Repository Manager 7.6.14.0之前版本存在权限提升漏洞，该漏洞源于错误的程序对高级本地过程的调用。攻击者可利用该漏洞导致权限提升。

Severity

中

Patch Name

HPE Version Control Repository Manager权限提升漏洞的补丁

Patch Description

HPE Version Control Repository Manager是美国慧与科技（HPE）公司的一款版本控制存储库管理器。 HPE Version Control Repository Manager 7.6.14.0之前版本存在权限提升漏洞，该漏洞源于不正确的程序对高级本地过程的调用。攻击者可利用该漏洞导致权限提升。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04310en_us

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-28619

Impacted products

Name
HPE Control Repository Manager <7.6.14.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-28619",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-28619"
    }
  },
  "description": "HPE Version Control Repository Manager\u662f\u7f8e\u56fd\u6167\u4e0e\u79d1\u6280\uff08HPE\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7248\u672c\u63a7\u5236\u5b58\u50a8\u5e93\u7ba1\u7406\u5668\u3002\n\nHPE Version Control Repository Manager 7.6.14.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9519\u8bef\u7684\u7a0b\u5e8f\u5bf9\u9ad8\u7ea7\u672c\u5730\u8fc7\u7a0b\u7684\u8c03\u7528\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6743\u9650\u63d0\u5347\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04310en_us",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-67143",
  "openTime": "2022-09-27",
  "patchDescription": "HPE Version Control Repository Manager\u662f\u7f8e\u56fd\u6167\u4e0e\u79d1\u6280\uff08HPE\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7248\u672c\u63a7\u5236\u5b58\u50a8\u5e93\u7ba1\u7406\u5668\u3002\r\n\r\nHPE Version Control Repository Manager 7.6.14.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4e0d\u6b63\u786e\u7684\u7a0b\u5e8f\u5bf9\u9ad8\u7ea7\u672c\u5730\u8fc7\u7a0b\u7684\u8c03\u7528\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6743\u9650\u63d0\u5347\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "HPE Version Control Repository Manager\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "HPE Control Repository Manager \u003c7.6.14.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-28619",
  "serverity": "\u4e2d",
  "submitTime": "2022-06-28",
  "title": "HPE Version Control Repository Manager\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2022-28619 (GCVE-0-2022-28619)

Vulnerability from cvelistv5 – Published: 2022-06-24 15:00 – Updated: 2024-08-03 05:56

Summary

A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalation of privilege. HPE has made the following software update to resolve the vulnerability in HPE Version Control Repository Manager installer 7.6.14.0.

Severity

No CVSS data available.

CWE

local escalation of privilege

Assigner

hpe

References

1 reference

URL	Tags
https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	HPE Version Control Repository Manager	Affected: Prior to v7.6.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:56:16.091Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04310en_us"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HPE Version Control Repository Manager",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Prior to v7.6.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalation of privilege. HPE has made the following software update to resolve the vulnerability in HPE Version Control Repository Manager installer 7.6.14.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "local escalation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-24T15:00:09.000Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04310en_us"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "ID": "CVE-2022-28619",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HPE Version Control Repository Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Prior to v7.6.14.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalation of privilege. HPE has made the following software update to resolve the vulnerability in HPE Version Control Repository Manager installer 7.6.14.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "local escalation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04310en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04310en_us"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2022-28619",
    "datePublished": "2022-06-24T15:00:09.000Z",
    "dateReserved": "2022-04-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T05:56:16.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-67143

CVE-2022-28619 (GCVE-0-2022-28619)

Tags

Sightings

Nomenclature