1. Home
  2. CVE Database
  3. CVE-2022-24552
CRITICAL · 9.8

CVE-2022-24552

A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker wi...

Vulnerability Description

A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
StarwindsoftwareNas< 0.2
StarwindsoftwareSan< 0.2

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2022-24552?

CVE-2022-24552 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker wi...

How severe is CVE-2022-24552?

CVE-2022-24552 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-24552?

Check the references section above for vendor advisories and patch information. Affected products include: Starwindsoftware Nas, Starwindsoftware San.