SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.
CVE-2022-50795
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2022-50795
Impact/Pulse/First
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Impact/Pulse Eco
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
BigVoice4
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
BigVoice2
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Stream
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WM2
Source reference: /containers/cna/affected/5/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "SOUND4 Ltd.",
"product": "Impact/Pulse/First",
"versions": [
{
"status": "affected",
"version": "Version 2: 1.1/2.15"
}
]
},
{
"vendor": "SOUND4 Ltd.",
"product": "Impact/Pulse Eco",
"versions": [
{
"status": "affected",
"version": "1.16"
}
]
},
{
"vendor": "SOUND4 Ltd.",
"product": "BigVoice4",
"versions": [
{
"status": "affected",
"version": "1.2"
}
]
},
{
"vendor": "SOUND4 Ltd.",
"product": "BigVoice2",
"versions": [
{
"status": "affected",
"version": "1.30"
}
]
},
{
"vendor": "SOUND4 Ltd.",
"product": "Stream",
"versions": [
{
"status": "affected",
"version": "1.1/2.4.29"
}
]
},
{
"vendor": "Kantar Media",
"product": "WM2",
"versions": [
{
"status": "affected",
"version": "1.11"
}
]
}
]- Related CVEs
- CVE-2022-50795
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #7685 · Revision 1
- Added to Heist Feed
- Publisher date