← Zuruck zu CVEs
CVE-2022-2338
MEDIUM5.7
Beschreibung
Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server.
CVE Details
CVSS v3.1 Bewertung5.7
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AngriffsvektorADJACENT_NETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionREQUIRED
Veroffentlicht8/17/2022
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
softing:edgeaggregatorsofting:edgeconnectorsofting:opcsofting:opc_ua_c\+\+_software_development_kitsofting:secure_integration_serversofting:uagates
Schwachen (CWE)
CWE-319
Referenzen
https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html(ics-cert@hq.dhs.gov)
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04(ics-cert@hq.dhs.gov)
https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.