CVE-2022-38129

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-24

Affected software

Vendor	Product	Versions
n/a	Keysight Technologies Sensor Management Server	Keysight Technologies Sensor Management Server v2.4.0

References

https://www.tenable.com/security/research/tra-2022-28Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2022-28Exploit, Third Party Advisory

Timeline

Published: Aug 10, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-38136.5A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The man CVE-2022-381309.8The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes CVE-2022-381316.1RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to mal CVE-2022-381328.8Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacke CVE-2022-381335.3In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases CVE-2022-381348.8Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-381354.3Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher CVE-2022-381367.3Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.CVE-2022-381378.8Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.CVE-2022-381387.5The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and CVE-2022-381398.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.CVE-2022-38146.5A vulnerability classified as problematic was found in Axiomatic Bento4. This vulnerability affects unknown code of the component mp4decrypt