CVE-2022-47529
CVE-2022-47529 is a medium-severity vulnerability in Rsa Netwitness with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 6.7)
- EPSS exploit prediction: 2% (72nd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Rsa Netwitness
- Published:
- Last modified:
Description
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
Frequently asked questions
- What is CVE-2022-47529?
- Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
- How severe is CVE-2022-47529?
- CVE-2022-47529 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2022-47529 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-47529?
- CVE-2022-47529 affects Rsa Netwitness. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-47529?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2022-47529 published?
- CVE-2022-47529 was published on 2023-03-28 and last updated on 2026-06-17.
References
- http://seclists.org/fulldisclosure/2023/Mar/26
- http://seclists.org/fulldisclosure/2024/Apr/17
- https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935
- https://github.com/hyp3rlinx/CVE-2022-47529
- https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt
- https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html
- https://seclists.org/fulldisclosure/2023/Mar/16
- https://twitter.com/hyp3rlinx/status/1639335477839790105
Affected products (1)
- cpe:2.3:a:rsa:netwitness:*:*:*:*:*:*:*:*
More vulnerabilities in Rsa Netwitness
- CVE-2019-3725 — Critical (CVSS 9.8): RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable…