CVE-2022-40983

An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617	Exploit Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1617

Configurations

Configuration 1 (hide)

cpe:2.3:a:qt:qt:6.3.2:*:*:*:*:*:*:*

History

21 Nov 2024, 07:22

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de desbordamiento de enteros en la API QML QtScript Reflect de Qt Project Qt 6.3.2. Un código JavaScript especialmente manipulado puede provocar un desbordamiento de enteros durante la asignación de memoria, lo que puede provocar la ejecución de código arbitrario. La aplicación de destino necesitaría acceder a una página web maliciosa para activar esta vulnerabilidad.
References		() https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1617 -
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617 - Exploit, Third Party Advisory~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617 - Exploit, Third Party Advisory

Information

Published : 2023-01-12 17:15

Updated : 2024-11-21 07:22

NVD link : CVE-2022-40983

Mitre link : CVE-2022-40983

CVE.ORG link : CVE-2022-40983

JSON object : View

Products Affected

qt

qt

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2022-40983", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-01-12T17:15:09.407", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1617", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de enteros en la API QML QtScript Reflect de Qt Project Qt 6.3.2. Un c\u00f3digo JavaScript especialmente manipulado puede provocar un desbordamiento de enteros durante la asignaci\u00f3n de memoria, lo que puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. La aplicaci\u00f3n de destino necesitar\u00eda acceder a una p\u00e1gina web maliciosa para activar esta vulnerabilidad."}], "lastModified": "2024-11-21T07:22:23.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qt:qt:6.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B80CA217-D896-4BCF-B385-582CDF21DAD6"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}