CVE-2022-1519 - Vulnerability Details - OpenCVE

LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Illumina	Iseq 100 Local Run Manager Miniseq Miseq Miseq Dx Nextseq 500 Nextseq 550 Nextseq 550dx

Configuration 1 [-]

AND

cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:illumina:iseq_100:-:::::::*
	cpe:2.3:h:illumina:miniseq:-:::::::*
	cpe:2.3:h:illumina:miseq:-:::::::*
	cpe:2.3:h:illumina:miseq_dx:-:::::::*
	cpe:2.3:h:illumina:nextseq_500:-:::::::*
	cpe:2.3:h:illumina:nextseq_550:-:::::::*
	cpe:2.3:h:illumina:nextseq_550dx:-:::::::*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-06-24T15:00:13.721889Z

Updated: 2024-09-16T18:12:48.155Z

Reserved: 2022-04-28T00:00:00

Link: CVE-2022-1519

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-06-24T15:15:09.333

Modified: 2024-11-21T06:40:53.367

Link: CVE-2022-1519

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "NextSeq 550Dx", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiSeq Dx", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "NextSeq 500 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "NextSeq 550 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiSeq Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "iSeq 100 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiniSeq Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}], "datePublic": "2022-06-02T00:00:00", "descriptions": [{"lang": "en", "value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-24T15:00:13", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}], "source": {"discovery": "UNKNOWN"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220602T06:00:00.000000Z", "ID": "CVE-2022-1519", "STATE": "PUBLIC", "TITLE": ""}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NextSeq 550Dx", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiSeq Dx", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "NextSeq 500 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "NextSeq 550 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiSeq Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "iSeq 100 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiniSeq Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}]}}, "credit": [], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}]}, "solution": [], "source": {"advisory": "", "defect": [], "discovery": "UNKNOWN"}, "work_around": []}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:03.403Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1519", "datePublished": "2022-06-24T15:00:13.721889Z", "dateReserved": "2022-04-28T00:00:00", "dateUpdated": "2024-09-16T18:12:48.155Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B", "versionEndIncluding": "3.1", "versionStartIncluding": "1.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*", "matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*", "matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*", "matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*", "matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."}, {"lang": "es", "value": "LRM no restringe los tipos de archivos que pueden cargarse en el producto afectado. Un actor malicioso puede cargar cualquier tipo de archivo, incluyendo c\u00f3digo ejecutable que permite una explotaci\u00f3n de c\u00f3digo remoto"}], "id": "CVE-2022-1519", "lastModified": "2024-11-21T06:40:53.367", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-24T15:15:09.333", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}