Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-36633

Good to know:

icon

Date: August 24, 2022

Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.

Language: Go

Severity Score

Related Resources (10)

https://github.com/gravitational/teleport/pull/14726/commits/46c23b9b64b944d1e82d2c8a79083f291ffdd3b6
https://github.com/gravitational/teleport/releases/tag/v8.3.17
https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html
http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html
https://github.com/gravitational/teleport/releases/tag/v10.1.2
https://github.com/gravitational/teleport/releases/tag/v9.3.13
https://github.com/gravitational/teleport
https://nvd.nist.gov/vuln/detail/CVE-2022-36633
https://github.com/gravitational/teleport/pull/14726
https://www.mend.io/vulnerability-database/CVE-2022-36633

Severity Score

Weakness Type (CWE)

Command Injection

CWE-77

Input Validation

CWE-20

OS Command Injections

CWE-78

Top Fix

icon

Upgrade Version

Upgrade to version v8.3.17,v9.3.13,v10.1.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us