Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-38130

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tenable

Description

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Keysight Technologies Sensor Management Server

  • Keysight Technologies Sensor Management Server v2.4.0affected

References