CVE-2022-35221 (GCVE-0-2022-35221)

Vulnerability from cvelistv5 – Published: 2022-08-02 15:20 – Updated: 2024-09-16 22:55
VLAI?
Title
TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2
Summary
Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
TEAMPLUS TECHNOLOGY INC. Teamplus Pro Affected: unspecified , ≤ 3.011.6.0.1 (custom)
Create a notification for this product.
    TEAMPLUS TECHNOLOGY INC. Teamplus Pro Affected: unspecified , ≤ 3.011.6.0.1 (custom)
Create a notification for this product.
Date Public ?
2022-07-29 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:29:17.389Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Android"
          ],
          "product": "Teamplus Pro",
          "vendor": "TEAMPLUS TECHNOLOGY INC.",
          "versions": [
            {
              "lessThanOrEqual": "3.011.6.0.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "iOS"
          ],
          "product": "Teamplus Pro",
          "vendor": "TEAMPLUS TECHNOLOGY INC.",
          "versions": [
            {
              "lessThanOrEqual": "3.011.6.0.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-07-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Teamplus Pro community discussion has an \u2018allocation of resource without limits or throttling\u2019 vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-02T15:20:44.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Contact tech support from TEAMPLUS."
        }
      ],
      "source": {
        "advisory": "TVN-202207005",
        "discovery": "EXTERNAL"
      },
      "title": "TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2022-07-29T07:05:00.000Z",
          "ID": "CVE-2022-35221",
          "STATE": "PUBLIC",
          "TITLE": "TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Teamplus Pro",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Android",
                            "version_affected": "\u003c=",
                            "version_value": "3.011.6.0.1"
                          },
                          {
                            "platform": "iOS",
                            "version_affected": "\u003c=",
                            "version_value": "3.011.6.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TEAMPLUS TECHNOLOGY INC."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Teamplus Pro community discussion has an \u2018allocation of resource without limits or throttling\u2019 vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-770 Allocation of Resources Without Limits or Throttling"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Contact tech support from TEAMPLUS."
          }
        ],
        "source": {
          "advisory": "TVN-202207005",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2022-35221",
    "datePublished": "2022-08-02T15:20:44.721Z",
    "dateReserved": "2022-07-05T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:55:47.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-35221",
      "date": "2026-04-25",
      "epss": "0.00378",
      "percentile": "0.59365"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:teamplus:team\\\\+_pro:*:*:*:*:private_cloud:android:*:*\", \"versionEndIncluding\": \"3.011.6.0.1\", \"matchCriteriaId\": \"266BDB81-BE36-4A9D-BE19-9B96516B4E58\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:teamplus:team\\\\+_pro:*:*:*:*:private_cloud:iphone_os:*:*\", \"versionEndIncluding\": \"3.011.6.0.1\", \"matchCriteriaId\": \"3E7BB0AB-B190-4997-9873-4E8C5FA60DED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Teamplus Pro community discussion has an \\u2018allocation of resource without limits or throttling\\u2019 vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.\"}, {\"lang\": \"es\", \"value\": \"Teamplus Pro community discussion presenta una vulnerabilidad de \\\"asignaci\\u00f3n de recursos sin l\\u00edmites o estrangulamiento\\\" en el campo de asunto del hilo. Un atacante remoto con privilegio de usuario general que publique un tema de hilo con gran contenido puede causar que el servidor asigne demasiada memoria, conllevando a una p\\u00e9rdida de contenido parcial de los mensajes y la interrupci\\u00f3n del servicio parcial\"}]",
      "id": "CVE-2022-35221",
      "lastModified": "2024-11-21T07:10:55.227",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"twcert@cert.org.tw\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.5}]}",
      "published": "2022-08-02T16:15:10.707",
      "references": "[{\"url\": \"https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html\", \"source\": \"twcert@cert.org.tw\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "twcert@cert.org.tw",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"twcert@cert.org.tw\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-35221\",\"sourceIdentifier\":\"twcert@cert.org.tw\",\"published\":\"2022-08-02T16:15:10.707\",\"lastModified\":\"2024-11-21T07:10:55.227\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Teamplus Pro community discussion has an \u2018allocation of resource without limits or throttling\u2019 vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.\"},{\"lang\":\"es\",\"value\":\"Teamplus Pro community discussion presenta una vulnerabilidad de \\\"asignaci\u00f3n de recursos sin l\u00edmites o estrangulamiento\\\" en el campo de asunto del hilo. Un atacante remoto con privilegio de usuario general que publique un tema de hilo con gran contenido puede causar que el servidor asigne demasiada memoria, conllevando a una p\u00e9rdida de contenido parcial de los mensajes y la interrupci\u00f3n del servicio parcial\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:teamplus:team\\\\+_pro:*:*:*:*:private_cloud:android:*:*\",\"versionEndIncluding\":\"3.011.6.0.1\",\"matchCriteriaId\":\"266BDB81-BE36-4A9D-BE19-9B96516B4E58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:teamplus:team\\\\+_pro:*:*:*:*:private_cloud:iphone_os:*:*\",\"versionEndIncluding\":\"3.011.6.0.1\",\"matchCriteriaId\":\"3E7BB0AB-B190-4997-9873-4E8C5FA60DED\"}]}]}],\"references\":[{\"url\":\"https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html\",\"source\":\"twcert@cert.org.tw\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.