CVE-2022-3812

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-401

Affected software

Vendor	Product	Versions
Axiomatic	Bento4	n/a

References

https://github.com/axiomatic-systems/Bento4/files/9726934/POC_mp4encrypt_631000973.zipExploit, Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/792Issue Tracking, Third Party Advisory
https://vuldb.com/?id.212678Third Party Advisory
https://github.com/axiomatic-systems/Bento4/files/9726934/POC_mp4encrypt_631000973.zipExploit, Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/792Issue Tracking, Third Party Advisory
https://vuldb.com/?id.212678Third Party Advisory

Timeline

Published: Nov 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-381206.5UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass auth CVE-2022-381216.5UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege c CVE-2022-381227.5UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to ac CVE-2022-381237.2Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code int CVE-2022-381246.5Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.CVE-2022-381255.5Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiti CVE-2022-381299.8A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor M CVE-2022-38136.5A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The man CVE-2022-381309.8The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes CVE-2022-381316.1RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to mal CVE-2022-381328.8Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacke CVE-2022-381335.3In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases