Veille CVE
CVE-2022-23748
7.8 Élevée Exploitée activementCatalogue CISA KEV — Dante Discovery Process Control Vulnerability
Ajoutée le 06/02/2025 · Échéance de correction (agences US) : 27/02/2025
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 7.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://cpr-zero.checkpoint.com/vulns/cprid-2193/%2C Broken Link
- https://www.audinate.com/learning/faqs/audinate-response-to-dante-discovery-mdnsresponder-exe-security-issue-cve-2022-23748 Vendor Advisory
- https://cpr-zero.checkpoint.com/vulns/cprid-2193/%2C Broken Link
- https://www.audinate.com/learning/faqs/audinate-response-to-dante-discovery-mdnsresponder-exe-security-issue-cve-2022-23748 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23748 US Government Resource