CVE-2022-4823

Low

Description

A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.

SeverityLow

CVSS3.1

Exploit probability—

ProductInstedd Nuntium

PublishedDec 28, 2022

First seenDec 28, 2022

Weakness typeCWE-208CWE-208

How to fix

Update

instedd nuntium2022-11-23 or later

Patches

github.com/instedd/nuntium/commit/77236f7fd71a0e2eefeea07f9866b069d612cf0d

Affected products

Product	Affected versions	Fixed in
instedd nuntium	v < 2022-11-23	2022-11-23

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.