High severity · published Dec 13, 2022
CVE-2022-45871
A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP request
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP request. The exploit can be triggered remotely by an attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Atlant · F-secure
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45871
Third Party Advisory
https://www.withsecure.com/en/support/security-advisories
More from Atlant
7.8
CVE-2023-43766
Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler
7.5
CVE-2023-49322
Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash
7.5
CVE-2023-43767
Certain WithSecure products allow Denial of Service via the aepack archive unpack handler
7.5
CVE-2023-43765
Certain WithSecure products allow Denial of Service in the aeelf component
7.5
CVE-2023-43761
Certain WithSecure products allow Denial of Service (infinite loop)