CVE-2022-29549

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e.g., to help ensure that a program was installed by root) and without integrity checks (e.g., a checksum comparison against known legitimate programs). Also, the vendor recommendation is to install this agent software with root privileges. Thus, privilege escalation is possible on systems where any of these pathnames is controlled by a non-root user. An example is /opt/firebird/bin/isql, where the /opt/firebird directory is often owned by the firebird user.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2022/Sep/10Mailing List, Third Party Advisory
http://software.firstworks.com/p/getting-started-with-firebird.htmlNot Applicable
https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linuxVendor Advisory
https://blog.qualys.com/vulnerabilities-threat-researchVendor Advisory
http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2022/Sep/10Mailing List, Third Party Advisory
http://software.firstworks.com/p/getting-started-with-firebird.htmlNot Applicable
https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linuxVendor Advisory
https://blog.qualys.com/vulnerabilities-threat-researchVendor Advisory

Timeline

Published: Aug 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-295505.5An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file CVE-2022-295558.8The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking.CVE-2022-295569.8The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provide CVE-2022-295578.8LexisNexis Firco Compliance Link 3.7 allows CSRF.CVE-2022-295588.8Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.CVE-2022-29566.1A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/user CVE-2022-295607.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDC CVE-2022-295618.8A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGE CVE-2022-295625.3A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGE CVE-2022-295647.5Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrast CVE-2022-295668.1The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values fr CVE-2022-295677.5The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.