CVE-2022-2985

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-298508.1Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence CVE-2022-298519.8documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file CVE-2022-298525.4OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-298535.4OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.CVE-2022-298546.8A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated at CVE-2022-298556.8Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and CVE-2022-298567.5A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.CVE-2022-298584.3Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by chang CVE-2022-298599.8component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet d CVE-2022-29868.8Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.CVE-2022-298627.5An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.CVE-2022-298637.5OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.