CVE-2022-21822

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
NVIDIA	NVIDIA FLARE	All versions prior to 2.0.16

References

https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47Patch, Third Party Advisory
https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47Patch, Third Party Advisory

Timeline

Published: Mar 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-218235.5A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacke CVE-2022-218248.2Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties CVE-2022-218257.8An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow a CVE-2022-218265.4Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request,CVE-2022-218277.1An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 w CVE-2022-218287.2A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a uns CVE-2022-218299.8Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which c CVE-2022-21837.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-218306.1A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in CVE-2022-218319.8A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing argu CVE-2022-218337.8Virtual Machine IDE Drive Elevation of Privilege Vulnerability CVE-2022-218347.8Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability