Skip to content
Heist/ feed
High

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.php

Type: advisorySource: Official CVE List1 source record

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the vulnerable ping.php script, which triggers the malicious file and then deletes it.

Announced Source revision 1
Original source ↗

CVE-2022-50791

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-50791

Impact/Pulse/First

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Impact/Pulse Eco

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

BigVoice4

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

BigVoice2

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Stream

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

WM2

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Impact/Pulse/First",
    "versions": [
      {
        "status": "affected",
        "version": "Version 2: 1.1/2.15"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Impact/Pulse Eco",
    "versions": [
      {
        "status": "affected",
        "version": "1.16"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "BigVoice4",
    "versions": [
      {
        "status": "affected",
        "version": "1.2"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "BigVoice2",
    "versions": [
      {
        "status": "affected",
        "version": "1.30"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Stream",
    "versions": [
      {
        "status": "affected",
        "version": "1.1/2.4.29"
      }
    ]
  },
  {
    "vendor": "Kantar Media",
    "product": "WM2",
    "versions": [
      {
        "status": "affected",
        "version": "1.11"
      }
    ]
  }
]
Related CVEs
CVE-2022-50791

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#7681 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement