CVE-2022-48217

The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is "it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not."

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tradr-project/tf_remapper_cpp/issues/1	Exploit Issue Tracking Third Party Advisory
https://github.com/tradr-project/tf_remapper_cpp/issues/1	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tradr-project:tf_remapper:1.1.1:*:*:*:*:robot_operating_system:*:*

History

No history.

Information

Published : 2023-01-04 19:15

Updated : 2024-11-21 07:32

NVD link : CVE-2022-48217

Mitre link : CVE-2022-48217

CVE.ORG link : CVE-2022-48217

JSON object : View

Products Affected

tradr-project

tf_remapper

CWE

NVD-CWE-noinfo CWE-75

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

{"id": "CVE-2022-48217", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2023-01-04T19:15:09.517", "references": [{"url": "https://github.com/tradr-project/tf_remapper_cpp/issues/1", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/tradr-project/tf_remapper_cpp/issues/1", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-75"}]}], "descriptions": [{"lang": "en", "value": "The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is \"it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not.\""}, {"lang": "es", "value": "El componente tf_remapper_node 1.1.1 para Robot Operating System (ROS) permite a atacantes, que controlan el c\u00f3digo fuente de un nodo diferente en la misma aplicaci\u00f3n ROS, cambiar el comportamiento de un robot. Esto ocurre porque el nombre de un tema depende del par\u00e1metro old_tf_topic_name y/o new_tf_topic_name controlado por el atacante. NOTA: la posici\u00f3n del proveedor es \"es responsabilidad del programador asegurarse de que s\u00f3lo se establezcan los par\u00e1metros conocidos y requeridos y no los par\u00e1metros inesperados\"."}], "lastModified": "2024-11-21T07:32:58.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tradr-project:tf_remapper:1.1.1:*:*:*:*:robot_operating_system:*:*", "vulnerable": true, "matchCriteriaId": "D7356FC1-E3F7-440B-BF28-57945CFE8C70"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}