CVE-2022-32272
Published: 09 June 2022
Summary
CVE-2022-32272 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Opswat Metadefender. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
OPSWAT MetaDefender Core before version 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 contain an incorrect access control vulnerability that permits privilege escalation. The flaw is tracked as CWE-269 and carries a CVSS 3.1 score of 9.8, reflecting network attack vectors that require no authentication or user interaction.
An unauthenticated remote attacker can exploit the weakness to obtain elevated privileges on the affected MetaDefender installations, resulting in full compromise of confidentiality, integrity, and availability. Public proof-of-concept code targeting MetaDefender Core 4.21.1 has been published, confirming that the issue is reachable over the network without credentials.
Vendor release notes for MetaDefender Core 5.1.2, ICAP 4.12.1, and Email Gateway Security 5.6.1 address the access-control defect; organizations should apply these updates to eliminate the escalation path. The CVE maintains an EPSS score near 0.21 with a recorded peak of 0.23, indicating sustained but not sharply increasing exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53469
Vulnerability details
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.