CVE-2022-31795 - CVE House
Back to Database
Status published Critical CVE-2022-31795

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control...

Vulnerability Description

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31795

Credits & Attribution

No credits recorded in the NVD database.

References

More from fujitsu

View All →
CVE-2022-31794
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control...
Critical 9.8
CVE-2022-28806
An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510,...
High 7.8
CVE-2022-27089
In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path...
High 7.8
CVE-2020-29127
An issue was discovered on Fujitsu Eternus Storage DX200 S4...
Critical 9.8
CVE-2020-17457
Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated...
Medium 5.4

Affected Vendor

Affected Software

eternus cs8000 firmware
Vulnerable Versions:
0, 8.1

Timeline

Official Publish: June 20th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.