CVE-2022-47529

EPSS 1.6%

Vexday Risk Score

23Baixo

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Prova de conceito

PoC popular no GitHub (1 estrelas) — código de exploração amplamente disponível.

CVSS —EPSS 1.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Ciclo de vida

24 mar 2023PoC pública

28 mar 2023Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 3

githubgithub.com/hyp3rlinx/CVE-2022-47529★ 1 cve_referencepacketstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.htmlnão verificado exploitdbwww.exploit-db.com/exploits/51336não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Referências

https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935 http://seclists.org/fulldisclosure/2023/Mar/26 http://seclists.org/fulldisclosure/2024/Apr/17 https://github.com/hyp3rlinx/CVE-2022-47529 https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html https://seclists.org/fulldisclosure/2023/Mar/16 https://twitter.com/hyp3rlinx/status/1639335477839790105