TI-2022-11758 Aliases CVE-2022-29215

Argument Injection in RegionProtect

MEDIUM 41CWE-88Published 2022-05-21 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a workaround, restrict operator permissions to untrusted people and avoid entering arguments likely to cause a crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01195 68th percentileScored 2026-11-07

Fix Fixed RegionProtect (kaidomc-pm-pl): 1.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kaidomc-pm-pl	RegionProtect	before 1.1.0	1.1.0	Patch available	CNA

RegionProtect Vendorkaidomc-pm-pl Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:regionprotect_project:regionprotect::::::::	before 1.1.0	Vulnerable	Regionprotect Project

cpe:2.3:a:regionprotect_project:regionprotect:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Regionprotect Project

Remediation

Fix · CNA RegionProtect (kaidomc-pm-pl) Fixed in 1.1.0

Timeline

2026-10-02 Threatist record created from CVE-2022-29215

References

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences