← Database

CVE-2022-1399

CRITICAL CVSS: 9.1 Published: 2022-08-17 Modified: 2026-06-17

Description

An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.

Affected Platforms

Device42 Cmdb

Weakness Type

CWE-88, CWE-88

References