{"id":"CVE-2022-34668","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-34668","generatedAt":"2026-11-05T00:02:50.771Z","title":"NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and…","description":"NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.","published":"2022-08-29T03:15:08.000Z","lastModified":"2026-06-17T04:50:41.000Z","status":"Modified","sourceIdentifier":"psirt@nvidia.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-502"],"affected":["nvidia/nvflare"],"epss":{"score":0.11608,"percentile":0.96048,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2023-03-25","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":51051,"kind":"exploit","title":"NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle","url":"https://www.exploit-db.com/exploits/51051","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/python/remote/51051.txt","file":"exploits/python/remote/51051.txt","published":"2023-03-25","added":"2023-03-25","updated":"2023-03-25","author":"Elias Hohl","type":"remote","platform":"python","port":null,"verified":false,"codes":["CVE-2022-34668"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 11.6%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html","source":"psirt@nvidia.com"},{"url":"https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6","tags":["Third Party Advisory"],"source":"psirt@nvidia.com"},{"url":"http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-34668","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}