CVE-2022-36436 json
VNCAuthProxy authentication bypass vulnerability
published 2022-09-14 4 y ago modified 2026-06-17 4 mo ago also GHSA-237r-mx84-7x8c , PYSEC-2022-267 , EUVD-2022-0351
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.
Patch / fix
- pypi vncauthproxy 1.2.0
- osuosl twisted_vnc_authentication_proxy 1.2.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
2.12% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- cert.grnet.gr https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vncauthproxy | <1.2.0 |
1.2.0 |
Affected products
- osuosl twisted_vnc_authentication_proxy
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644b
web, patch
-
cert.grnet.gr
/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/
exploit, patch, article
-
github.com
/osuosl/twisted_vncauthproxy/tree/release/1.1.1
web, release-notes
-
pypi.org
/project/VNCAuthProxy/
product, package
-
nvd.nist.gov
/vuln/detail/CVE-2022-36436
advisory
-
cert.grnet.gr
/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass
web
-
github.com
/osuosl/twisted_vncauthproxy
package
-
github.com
/pypa/advisory-database/tree/main/vulns/vncauthproxy/PYSEC-2022-267.yaml
web
-
pypi.org
/project/VNCAuthProxy
web
-
github.com
/advisories/GHSA-237r-mx84-7x8c
advisory
Sources
- CVE List CVE-2022-36436
- GitHub Advisory GHSA-237r-mx84-7x8c
- NVD CVE-2022-36436
- OSV PYSEC-2022-267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.