# KEV Entries That Require Vendor Updates KEV CVEs whose required action is exactly “Apply updates per vendor instructions.”. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/cisa-required-action/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` KEV CVEs whose required action is exactly “Apply updates per vendor instructions.”. Example 3 of 4 in **Filters › NVD KEV Fields** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `cisa_required_action` · `operator` `eq` `cisa_required_action` is the action CISA requires. `eq` matches the exact value `Apply updates per vendor instructions.`. In the response, look at `results[].cisa_required_action`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `cisa_required_action` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `Apply updates per vendor instructions.` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "cisa_required_action", "type": "eq", "value": "Apply updates per vendor instructions." } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].references: first 10 items; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 893, "results": [ { "id": "CVE-2022-22947", "source_identifier": "user@vmware.com", "published": "2022-03-03T22:15:08Z", "last_modified": "2026-06-17T04:29:13Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2022-05-16", "cisa_action_due": "2022-06-06", "cisa_required_action": "Apply updates per vendor instructions.", "cisa_vulnerability_name": "VMware Spring Cloud Gateway Code Injection Vulnerability", "descriptions": [ { "lang": "en", "value": "In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host." }, { "lang": "es", "value": "En spring cloud gateway versiones anteriores a 3.1.1+ y a 3.0.7+ , las aplicaciones son vulnerables a un ataque de inyección de código cuando el endpoint del Actuador de la Puerta de Enlace está habilitado, expuesto y sin seguridad. Un atacante remoto podría realizar una petición maliciosamente diseñada que podría permitir una ejecución remota arbitraria en el host remoto" } ], "references": [ { "url": "http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html", "source": "user@vmware.com", "tags": [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url": "http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html", "source": "user@vmware.com", "tags": [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url": "https://tanzu.vmware.com/security/cve-2022-22947", "source": "user@vmware.com", "tags": [ "Mitigation", "Vendor Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "source": "user@vmware.com", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html", "source": "user@vmware.com", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url": "http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url": "https://tanzu.vmware.com/security/cve-2022-22947", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mitigation", "Vendor Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "MEDIUM", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 6.8, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "MEDIUM", "exploitability_score": 8.6, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@vmware.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-94" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-917" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*", "match_criteria_id": "ED6E19AB-5568-4296-99CD-DC54EC30E518", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "3.0.7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_cloud_gateway:3.1.0:*:*:*:*:*:*:*", "match_criteria_id": "71D24F3E-9DA8-491B-841F-BDF95B8000B0", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*", "match_criteria_id": "2A3622F5-5976-4BBC-A147-FC8A6431EA79", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*", "match_criteria_id": "10323322-F6C0-4EA7-9344-736F7A80AA5F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*", "match_criteria_id": "6EDB6772-7FDB-45FF-8D72-952902A7EE56", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*", "match_criteria_id": "3C2BC68D-C8B2-4C8B-9426-21F00CBDD873", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*", "match_criteria_id": "E24426EE-6A3F-413E-A70A-FB98CCD007A1", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*", "match_criteria_id": "C2A5B24D-BDF2-423C-98EA-A40778C01A05", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*", "match_criteria_id": "6F60E32F-0CA0-4C2D-9848-CB92765A9ACB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*", "match_criteria_id": "DF616620-88CE-4A77-B904-C1728A2E6F9B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*", "match_criteria_id": "A264E0DE-209D-49B1-8B26-51AB8BBC97F1", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*", "match_criteria_id": "EBB5FF32-7362-4A1E-AD24-EF6B8770FCAD", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*", "vendor": "vmware", "product": "spring_cloud_gateway", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "3.0.7", "affected_versions_first": "1.0.0", "affected_versions_last": "3.0.6" }, { "criteria": "cpe:2.3:a:vmware:spring_cloud_gateway:3.1.0:*:*:*:*:*:*:*", "vendor": "vmware", "product": "spring_cloud_gateway", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "3.1.0", "affected_versions_last": "3.1.0" }, { "criteria": "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*", "vendor": "oracle", "product": "commerce_guided_search", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "11.3.2", "affected_versions_last": "11.3.2" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_binding_support_function", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.11.0", "affected_versions_last": "1.11.0" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_binding_support_function", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.1.3", "affected_versions_last": "22.1.3" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_console", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.2.0", "affected_versions_last": "22.2.0" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_network_exposure_function", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "22.1.0", "affected_versions_last": "22.1.0" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_network_function_cloud_native_environment", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.10.0", "affected_versions_last": "1.10.0" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_network_repository_function", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.15.0", "affected_versions_last": "1.15.0" }, { "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*", "vendor": "oracle", "product": "communications_cloud_native_core_network_repository_function", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.15.1", "affected_versions_last": "1.15.1" } ], "cwe": [ { "id": 917, "owasptop10_2021": null, "name": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "description": "The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.", "capec_id": null, "scope": [ "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] }, { "id": 94, "owasptop10_2021": "A03 Injection", "name": "Improper Control of Generation of Code ('Code Injection')", "description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.", "capec_id": [ 35, 77, 242 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Hide Activities" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.98253, "percentile": 0.99913, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "VMware", "product": "Spring Cloud Gateway", "vulnerability_name": "VMware Spring Cloud Gateway Code Injection Vulnerability", "date_added": "2022-05-16", "short_description": "Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.", "required_action": "Apply updates per vendor instructions.", "due_date": "2022-06-06", "known_ransomware_campaign_use": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947" }, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-22536", "source_identifier": "user@sap.com", "published": "2022-02-09T23:15:18Z", "last_modified": "2026-06-17T04:28:33Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2022-08-18", "cisa_action_due": "2022-09-08", "cisa_required_action": "Apply updates per vendor instructions.", "cisa_vulnerability_name": "SAP Multiple Products HTTP Request Smuggling Vulnerability", "descriptions": [ { "lang": "en", "value": "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system." }, { "lang": "es", "value": "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 y SAP Web Dispatcher son vulnerables para el contrabando de peticiones y la concatenación de peticiones. Un atacante no autenticado puede añadir datos arbitrarios a la petición de la víctima. De este modo, el atacante puede ejecutar funciones suplantando a la víctima o envenenar las cachés web intermediarias. Un ataque con éxito podría resultar en el compromiso completo de la Confidencialidad, Integridad y Disponibilidad del sistema" } ], "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3123396", "source": "user@sap.com", "tags": [ "Permissions Required" ] }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "source": "user@sap.com", "tags": [ "Broken Link", "Not Applicable", "Vendor Advisory" ] }, { "url": "https://launchpad.support.sap.com/#/notes/3123396", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Permissions Required" ] }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link", "Not Applicable", "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "COMPLETE", "integrity_impact": "COMPLETE", "availability_impact": "COMPLETE", "base_score": 10.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 10.0, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@sap.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-444" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-444" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*", "match_criteria_id": "A02FB973-7FA0-4881-B912-27F4CFBDC673", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*", "match_criteria_id": "16B3C589-DF11-459D-8A3F-1A1FD2265022", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*", "match_criteria_id": "9FBC5614-7C3F-4AD8-8640-0499B8B03C64", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*", "match_criteria_id": "9E8CB869-C342-4362-9A4A-298F0B5F4003", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*", "match_criteria_id": "89E7439E-F4D6-45EA-99FC-C9B34D4D590E", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*", "match_criteria_id": "252DCEF2-8DDF-467F-8869-B69A0A3426F8", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*", "match_criteria_id": "9BC578BE-2308-491E-9D56-6B45AFF0FCFA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.86:*:*:*:*:*:*:*", "match_criteria_id": "7C0E10A3-591A-4FA7-9B98-D54C3D6C63FA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.87:*:*:*:*:*:*:*", "match_criteria_id": "150B6370-F18A-4657-95ED-D969BF7C39CE", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:8.04:*:*:*:*:*:*:*", "match_criteria_id": "12974FFA-3168-4A80-ACFB-D5E065A89383", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*", "vendor": "sap", "product": "content_server", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.53", "affected_versions_last": "7.53" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.22", "affected_versions_last": "7.22" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.49", "affected_versions_last": "7.49" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.53", "affected_versions_last": "7.53" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.77", "affected_versions_last": "7.77" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.81", "affected_versions_last": "7.81" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.85", "affected_versions_last": "7.85" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.86:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.86", "affected_versions_last": "7.86" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.87:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.87", "affected_versions_last": "7.87" }, { "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:8.04:*:*:*:*:*:*:*", "vendor": "sap", "product": "netweaver_application_server_abap", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "8.04", "affected_versions_last": "8.04" } ], "cwe": [ { "id": 444, "owasptop10_2021": "A04 Insecure Design", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "description": "The product acts as an intermediary HTTP agent\n (such as a proxy or firewall) in the data flow between two\n entities such as a client and server, but it does not\n interpret malformed HTTP requests or responses in ways that\n are consistent with how the messages will be processed by\n those entities that are at the ultimate destination.", "capec_id": [ 33, 273 ], "scope": [ "Access Control", "Integrity", "Non-Repudiation" ], "impact": [ "Bypass Protection Mechanism", "Hide Activities", "Unexpected State" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.97945, "percentile": 0.99907, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "SAP", "product": "Multiple Products", "vulnerability_name": "SAP Multiple Products HTTP Request Smuggling Vulnerability", "date_added": "2022-08-18", "short_description": "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.", "required_action": "Apply updates per vendor instructions.", "due_date": "2022-09-08", "known_ransomware_campaign_use": "Unknown", "notes": "SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso; https://nvd.nist.gov/vuln/detail/CVE-2022-22536" }, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-0543", "source_identifier": "user@debian.org", "published": "2022-02-18T20:15:17Z", "last_modified": "2026-06-17T04:20:48Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2022-03-28", "cisa_action_due": "2022-04-18", "cisa_required_action": "Apply updates per vendor instructions.", "cisa_vulnerability_name": "Debian-specific Redis Server Lua Sandbox Escape Vulnerability", "descriptions": [ { "lang": "en", "value": "It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution." }, { "lang": "es", "value": "Se ha detectado que redis, una base de datos persistente de valores clave, debido a un problema de empaquetado, es propenso a un escape del sandbox de Lua (específico de Debian), que podría resultar en una ejecución de código remota" } ], "references": [ { "url": "http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html", "source": "user@debian.org", "tags": [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url": "https://bugs.debian.org/1005787", "source": "user@debian.org", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://lists.debian.org/debian-security-announce/2022/msg00048.html", "source": "user@debian.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://security.netapp.com/advisory/ntap-20220331-0004/", "source": "user@debian.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.debian.org/security/2022/dsa-5081", "source": "user@debian.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce", "source": "user@debian.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url": "https://bugs.debian.org/1005787", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://lists.debian.org/debian-security-announce/2022/msg00048.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://security.netapp.com/advisory/ntap-20220331-0004/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "COMPLETE", "integrity_impact": "COMPLETE", "availability_impact": "COMPLETE", "base_score": 10.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 10.0, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-862" } ] }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-862" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:redis:redis:-:*:*:*:*:*:*:*", "match_criteria_id": "5EBE5E1C-C881-4A76-9E36-4FB7C48427E6", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "match_criteria_id": "902B8056-9E37-443B-8905-8AA93E2447FB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:-:*:*:*", "match_criteria_id": "3D94DA3B-FA74-4526-A0A0-A872684598C6", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "match_criteria_id": "DEECE5FC-CACF-4496-A3E7-164736409252", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "match_criteria_id": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "match_criteria_id": "FA6FEEC2-9F11-4643-8827-749718254FED", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:redis:redis:-:*:*:*:*:*:*:*", "vendor": "redis", "product": "redis", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "vendor": "canonical", "product": "ubuntu_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "20.04", "affected_versions_last": "20.04" }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:-:*:*:*", "vendor": "canonical", "product": "ubuntu_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "21.10", "affected_versions_last": "21.10" }, { "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vendor": "debian", "product": "debian_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "9.0", "affected_versions_last": "9.0" }, { "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vendor": "debian", "product": "debian_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "10.0", "affected_versions_last": "10.0" }, { "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vendor": "debian", "product": "debian_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "11.0", "affected_versions_last": "11.0" } ], "cwe": [ { "id": 862, "owasptop10_2021": "A01 Broken Access Control", "name": "Missing Authorization", "description": "The product does not perform an authorization check when an actor attempts to access a resource or perform an action.", "capec_id": [ 665 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "DoS: Resource Consumption (Other)", "Gain Privileges or Assume Identity", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.99351, "percentile": 0.99939, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "Redis", "product": "Debian-specific Redis Servers", "vulnerability_name": "Debian-specific Redis Server Lua Sandbox Escape Vulnerability", "date_added": "2022-03-28", "short_description": "Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.", "required_action": "Apply updates per vendor instructions.", "due_date": "2022-04-18", "known_ransomware_campaign_use": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-0543" }, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVEs With a Spanish Description](/reference/vulnerability/search/examples/descriptions-lang/) - [CVEs Awaiting NVD Analysis](/reference/vulnerability/search/examples/status/) - [CVEs With an Exploit Reference](/reference/vulnerability/search/examples/references-tags/) - [CVSS v2: Secondary Scores](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-type/) - [CVSS v2: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-version/) - [One CVE by Id](/reference/vulnerability/search/examples/id/)