CVE-2022-40238: A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-26 · updated 2026-06-17
Weakness: CWE-502

Description

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

Affected products

CERT/CC VINCE: before 1.50.5 — fixed in 1.50.5

How to fix

Upgrade to a fixed version: CERT/CC VINCE 1.50.5. Check the vendor advisory for mitigations.

References

https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity
https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity

Get alerted when CVE-2022-40238 or the next vulnerability affects your stack