Insufficient verification of data authenticity in Apex One - CVE-2022-40139
Published: September 13, 2022
Vulnerability identifier: #VU67207
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-40139
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to improper input validation within the rollback functionality. A remote authenticated user with access to the administrative console can force the agent into downloading unverified rollback components and compromise the affected system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Apex One
How to mitigate CVE-2022-40139
Install updates from vendor's website.
Apex One - update to CP 11092