Communications Cloud Native Core Console

Vendor:

First CVE: Aug 20, 2019 · Active for 6 years

23
Total CVEs
More Total CVEs than 95% of tracked products
5.8
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
6.9
Avg CVSS
Higher Avg CVSS than 39% of tracked products
13.0%
KEV Rate
Higher KEV Rate than 98% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Communications Cloud Native Core Console over time

Volume of CVEsAvg CVSS Base Score
First CVE
Aug 20, 2019
6 years ago
Most Recent CVE
Apr 1, 2022
1,577 days ago

CVE Severity & Scoring

Communications Cloud Native Core Console23 CVEs
All CVEs352,719 CVEs
MediumHighCritical
Attack Vector
Local2 (8.7%)
Network21 (91.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low16 (69.6%)
High7 (30.4%)
Unknown0 (0.0%)
User Interaction
None20 (87.0%)
Unknown0 (0.0%)
Required3 (13.0%)
Privileges Required
Low5 (21.7%)
High1 (4.3%)
None17 (73.9%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (23 CVEs).

23 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2022-22963CRITICAL
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r
Apr 1, 20229.899YESYES
CVE-2022-22947CRITICAL
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unse
Mar 3, 202210.099YESYES
CVE-2022-22965CRITICAL
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run
Apr 1, 20229.898YESYES
CVE-2021-45105MEDIUM
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker wit
Dec 18, 20215.976NONO
CVE-2022-23221CRITICAL
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCR
Jan 19, 20229.868NONO
CVE-2021-3712HIGH
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont
Aug 24, 20217.453NONO
CVE-2019-10086HIGH
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property
Aug 20, 20197.340NONO
CVE-2022-24407HIGH
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
Feb 24, 20228.830NONO
CVE-2020-36518HIGH
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Mar 11, 20227.528NONO
CVE-2021-22946HIGH
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SS
Sep 29, 20217.527NONO
View all 23 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (23 CVEs).

CISA KEV
3 CVEs
13.0% of CVEs· 98th percentile
Metasploit
3 CVEs
13.0% of CVEs· 97th percentile
Nuclei
3 CVEs
13.0% of CVEs· 97th percentile
ExploitDB
2 CVEs
8.7% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (23 CVEs).

Media Mentions

Signals from CVEs in this product scope (23 CVEs).

Top CNAs Publishing CVEs For Communications Cloud Native Core Console

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
22.2.057.522.9%11
22.1.029.899.8%22
1.9.0156.829.7%22
1.7.026.03.5%00
1.4.017.329.8%00