CVE-2022-39199
Improper validation of UUIDs in github.com/codenotary/immudb
5.8
MEDIUM
CVSS 3.1
EPSS 0.12%
Description
A malicious server can trick a client into treating it as a different server by changing the reported UUID. immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. The SDK does not validate this UUID and accepts any value reported by the server. A malicious server can therefore change the reported UUID and trick the client into treating it as a different server.
How to fix CVE-2022-39199
To remediate CVE-2022-39199, upgrade the affected package to a fixed version below.
- —upgrade to 1.4.1 or later
- —upgrade to 1.4.1 or later
Is CVE-2022-39199 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 1.4.1
- from 0, < 1.4.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.8 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N |