CVE-2022-1519 (GCVE-0-2022-1519)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2025-04-16 16:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.
References
► | URL | Tags | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Illumina | NextSeq 550Dx |
Version: LRM Versions 1.3 to 3.1 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T00:10:03.403Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2022-1519", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-04-16T15:54:29.024230Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-04-16T16:17:02.637Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "NextSeq 550Dx", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] }, { "product": "MiSeq Dx", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] }, { "product": "NextSeq 500 Instrument", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] }, { "product": "NextSeq 550 Instrument", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] }, { "product": "MiSeq Instrument", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] }, { "product": "iSeq 100 Instrument", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] }, { "product": "MiniSeq Instrument", "vendor": "Illumina", "versions": [ { "status": "affected", "version": "LRM Versions 1.3 to 3.1" } ] } ], "datePublic": "2022-06-02T00:00:00.000Z", "descriptions": [ { "lang": "en", "value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-24T15:00:13.000Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02" } ], "source": { "discovery": "UNKNOWN" }, "x_legacyV4Record": { "CVE_data_meta": { "AKA": "", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220602T06:00:00.000000Z", "ID": "CVE-2022-1519", "STATE": "PUBLIC", "TITLE": "" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "NextSeq 550Dx", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" }, { "product": { "product_data": [ { "product_name": "MiSeq Dx", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" }, { "product": { "product_data": [ { "product_name": "NextSeq 500 Instrument", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" }, { "product": { "product_data": [ { "product_name": "NextSeq 550 Instrument", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" }, { "product": { "product_data": [ { "product_name": "MiSeq Instrument", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" }, { "product": { "product_data": [ { "product_name": "iSeq 100 Instrument", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" }, { "product": { "product_data": [ { "product_name": "MiniSeq Instrument", "version": { "version_data": [ { "platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1" } ] } } ] }, "vendor_name": "Illumina" } ] } }, "credit": [], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02" } ] }, "solution": [], "source": { "advisory": "", "defect": [], "discovery": "UNKNOWN" }, "work_around": [] } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1519", "datePublished": "2022-06-24T15:00:13.721Z", "dateReserved": "2022-04-28T00:00:00.000Z", "dateUpdated": "2025-04-16T16:17:02.637Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-1519\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2022-06-24T15:15:09.333\",\"lastModified\":\"2024-11-21T06:40:53.367\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.\"},{\"lang\":\"es\",\"value\":\"LRM no restringe los tipos de archivos que pueden cargarse en el producto afectado. Un actor malicioso puede cargar cualquier tipo de archivo, incluyendo c\u00f3digo ejecutable que permite una explotaci\u00f3n de c\u00f3digo remoto\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3\",\"versionEndIncluding\":\"3.1\",\"matchCriteriaId\":\"C6A76287-2C7D-4EDD-B551-3E162819A08B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0136ED72-BF05-404D-910A-DA5B73F69771\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DA69772-E795-4A64-A6A1-0BDD503D263B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7731600-AE91-4D74-A219-BAE147B29A7F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF742B4D-0FC5-443A-8040-7B0A1B298707\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D\"}]}]}],\"references\":[{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T00:10:03.403Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-1519\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-16T15:54:29.024230Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-16T15:54:30.477Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Illumina\", \"product\": \"NextSeq 550Dx\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"MiSeq Dx\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"NextSeq 500 Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"NextSeq 550 Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"MiSeq Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"iSeq 100 Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"MiniSeq Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}], \"datePublic\": \"2022-06-02T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434 Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2022-06-24T15:00:13.000Z\"}, \"x_legacyV4Record\": {\"credit\": [], \"impact\": {\"cvss\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"defect\": [], \"advisory\": \"\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"NextSeq 550Dx\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"MiSeq Dx\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"NextSeq 500 Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"NextSeq 550 Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"MiSeq Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"iSeq 100 Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"MiniSeq Instrument\"}]}, \"vendor_name\": \"Illumina\"}]}}, \"solution\": [], \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"name\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-434 Unrestricted Upload of File with Dangerous Type\"}]}]}, \"work_around\": [], \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-1519\", \"AKA\": \"\", \"STATE\": \"PUBLIC\", \"TITLE\": \"\", \"ASSIGNER\": \"ics-cert@hq.dhs.gov\", \"DATE_PUBLIC\": \"20220602T06:00:00.000000Z\"}}}}", "cveMetadata": "{\"cveId\": \"CVE-2022-1519\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-16T16:17:02.637Z\", \"dateReserved\": \"2022-04-28T00:00:00.000Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2022-06-24T15:00:13.721Z\", \"assignerShortName\": \"icscert\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…