CVE-2022-30284

moderate-risk
Published 2022-05-04

In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case

Do I need to act?

!
14.2% chance of exploitation in next 30 days
EPSS score — higher than 86% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10 Critical
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Python-Libnmap Project

References (8)

Release Notes https://github.com/savon-noir/python-libnmap/releases
Exploit https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process
Product https://pypi.org/project/python-libnmap/
Exploit https://www.swascan.com/security-advisory-libnmap-2/
Release Notes https://github.com/savon-noir/python-libnmap/releases
Exploit https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process
Product https://pypi.org/project/python-libnmap/
Exploit https://www.swascan.com/security-advisory-libnmap-2/
43
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 12/34 · Low
Exposure 5/34 · Minimal