Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by Device42

CVE-2022-1401 (GCVE-0-2022-1401)

Vulnerability from cvelistv5 – Published: 2022-08-16 23:30 – Updated: 2024-09-17 02:11
VLAI?
Title
Insufficient validation of provided paths in Exago WrImageResource.axd
Summary
Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00.
Severity ?
6.9 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
Device42 CMDB Affected: unspecified , < 18.01.00 (custom)
Create a notification for this product.
Date Public ?
2022-08-15 21:00
Credits
Ștefania POPESCU - Team Lead, Security @ Bitdefender Ionuț LALU - Security Engineer @ Bitdefender Cristian BUZA - Security Engineer @ Bitdefender Alexandru LAZĂR - Security Researcher @ Bitdefender
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:03:06.265Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CMDB",
          "vendor": "Device42",
          "versions": [
            {
              "lessThan": "18.01.00",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Cristian BUZA - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
        }
      ],
      "datePublic": "2022-08-15T21:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00.\u003c/p\u003e"
            }
          ],
          "value": "Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-20T09:18:04.118Z",
        "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
        "shortName": "Bitdefender"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn update to Device42 CMDB version 18.01.00 fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "An update to Device42 CMDB version 18.01.00 fixes the issue."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Insufficient validation of provided paths in Exago WrImageResource.axd",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-requests@bitdefender.com",
          "DATE_PUBLIC": "2022-08-16T19:00:00.000Z",
          "ID": "CVE-2022-1401",
          "STATE": "PUBLIC",
          "TITLE": "Insufficient validation of provided paths in Exago WrImageResource.axd"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CMDB",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "18.01.00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Device42"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Cristian BUZA - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284 Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
              "refsource": "MISC",
              "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "An update to Device42 CMDB version 18.01.00 fixes the issue."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
    "assignerShortName": "Bitdefender",
    "cveId": "CVE-2022-1401",
    "datePublished": "2022-08-16T23:30:36.607Z",
    "dateReserved": "2022-04-19T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:11:37.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1410 (GCVE-0-2022-1410)

Vulnerability from cvelistv5 – Published: 2022-08-16 23:30 – Updated: 2024-09-16 22:35
VLAI?
Title
Remote Code Execution in Device42 ApplianceManager console
Summary
OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
Severity ?
8 (High)
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-78 - OS Command Injection
Assigner
References
Impacted products
Vendor Product Version
Device42 CMDB Affected: unspecified , < 18.01.00 (custom)
Create a notification for this product.
Date Public ?
2022-08-16 00:00
Credits
Ștefania POPESCU - Team Lead, Security @ Bitdefender Ionuț LALU - Security Engineer @ Bitdefender Cristian BUZA - Security Engineer @ Bitdefender Alexandru LAZĂR - Security Researcher @ Bitdefender
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:03:06.154Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CMDB",
          "vendor": "Device42",
          "versions": [
            {
              "lessThan": "18.01.00",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Cristian BUZA - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
        }
      ],
      "datePublic": "2022-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-16T23:30:18.000Z",
        "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
        "shortName": "Bitdefender"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "An update to Device42 CMDB version 18.01.00 fixes the issue."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Remote Code Execution in Device42 ApplianceManager console",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-requests@bitdefender.com",
          "DATE_PUBLIC": "2022-08-16T19:00:00.000Z",
          "ID": "CVE-2022-1410",
          "STATE": "PUBLIC",
          "TITLE": "Remote Code Execution in Device42 ApplianceManager console"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CMDB",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "18.01.00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Device42"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Cristian BUZA - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78 OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
              "refsource": "MISC",
              "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "An update to Device42 CMDB version 18.01.00 fixes the issue."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
    "assignerShortName": "Bitdefender",
    "cveId": "CVE-2022-1410",
    "datePublished": "2022-08-16T23:30:18.676Z",
    "dateReserved": "2022-04-20T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:35:09.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1400 (GCVE-0-2022-1400)

Vulnerability from cvelistv5 – Published: 2022-08-16 23:25 – Updated: 2024-09-16 22:36
VLAI?
Title
Hardcoded encryption key IV in Exago WebReportsApi.dll
Summary
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
Severity ?
7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE
  • CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
Impacted products
Vendor Product Version
Device42 CMDB Affected: unspecified , < 18.01.00 (custom)
Create a notification for this product.
Date Public ?
2022-08-16 00:00
Credits
Ștefania POPESCU - Team Lead, Security @ Bitdefender Ionuț LALU - Security Engineer @ Bitdefender Cristian BUZA - Security Engineer @ Bitdefender Alexandru LAZĂR - Security Researcher @ Bitdefender
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:03:06.249Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CMDB",
          "vendor": "Device42",
          "versions": [
            {
              "lessThan": "18.01.00",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Cristian BUZA - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
        }
      ],
      "datePublic": "2022-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-16T23:25:12.000Z",
        "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
        "shortName": "Bitdefender"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "An update to Device42 CMDB  version 19.01.00 fixes the issue."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Hardcoded encryption key IV in Exago WebReportsApi.dll",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-requests@bitdefender.com",
          "DATE_PUBLIC": "2022-08-16T19:00:00.000Z",
          "ID": "CVE-2022-1400",
          "STATE": "PUBLIC",
          "TITLE": "Hardcoded encryption key IV in Exago WebReportsApi.dll"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CMDB",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "18.01.00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Device42"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Cristian BUZA - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-321 Use of Hard-coded Cryptographic Key"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
              "refsource": "MISC",
              "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "An update to Device42 CMDB  version 19.01.00 fixes the issue."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
    "assignerShortName": "Bitdefender",
    "cveId": "CVE-2022-1400",
    "datePublished": "2022-08-16T23:25:12.477Z",
    "dateReserved": "2022-04-19T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:36:19.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1399 (GCVE-0-2022-1399)

Vulnerability from cvelistv5 – Published: 2022-08-16 23:20 – Updated: 2024-09-16 23:51
VLAI?
Title
Remote code execution in scheduled tasks component
Summary
An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-88 - Argument Injection or Modification
Assigner
References
Impacted products
Vendor Product Version
Device42 CMDB Affected: unspecified , < 18.01.00 (custom)
Create a notification for this product.
Date Public ?
2022-08-16 00:00
Credits
Ștefania POPESCU - Team Lead, Security @ Bitdefender Ionuț LALU - Security Engineer @ Bitdefender Cristian BUZA - Security Engineer @ Bitdefender Alexandru LAZĂR - Security Researcher @ Bitdefender
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:03:06.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CMDB",
          "vendor": "Device42",
          "versions": [
            {
              "lessThan": "18.01.00",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Cristian BUZA - Security Engineer @ Bitdefender"
        },
        {
          "lang": "en",
          "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
        }
      ],
      "datePublic": "2022-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Argument Injection or Modification vulnerability in the \"Change Secret\" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Argument Injection or Modification",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-16T23:20:10.000Z",
        "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
        "shortName": "Bitdefender"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "An update to version 18.01.00 fixes the issue"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Remote code execution in scheduled tasks component",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-requests@bitdefender.com",
          "DATE_PUBLIC": "2022-08-16T21:00:00.000Z",
          "ID": "CVE-2022-1399",
          "STATE": "PUBLIC",
          "TITLE": "Remote code execution in scheduled tasks component"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CMDB",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "18.01.00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Device42"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Cristian BUZA - Security Engineer @ Bitdefender"
          },
          {
            "lang": "eng",
            "value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An Argument Injection or Modification vulnerability in the \"Change Secret\" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-88 Argument Injection or Modification"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
              "refsource": "MISC",
              "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "An update to version 18.01.00 fixes the issue"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
    "assignerShortName": "Bitdefender",
    "cveId": "CVE-2022-1399",
    "datePublished": "2022-08-16T23:20:10.751Z",
    "dateReserved": "2022-04-19T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:51:14.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-41315 (GCVE-0-2021-41315)

Vulnerability from cvelistv5 – Published: 2021-09-17 14:46 – Updated: 2024-08-04 03:08
VLAI?
Summary
The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:08:32.067Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.device42.com/auto-discovery/remote-collector-rc/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-17T14:46:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.device42.com/auto-discovery/remote-collector-rc/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-41315",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console application) to execute arbitrary OS commands and escalate privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.device42.com/auto-discovery/remote-collector-rc/",
              "refsource": "MISC",
              "url": "https://docs.device42.com/auto-discovery/remote-collector-rc/"
            },
            {
              "name": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/",
              "refsource": "MISC",
              "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-41315",
    "datePublished": "2021-09-17T14:46:17.000Z",
    "dateReserved": "2021-09-17T00:00:00.000Z",
    "dateUpdated": "2024-08-04T03:08:32.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-41316 (GCVE-0-2021-41316)

Vulnerability from cvelistv5 – Published: 2021-09-17 14:45 – Updated: 2024-08-04 03:08
VLAI?
Summary
The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:08:31.942Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.device42.com/auto-discovery/remote-collector-rc/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.device42.com/auto-discovery/nmap-autodiscovery/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-17T14:45:53.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.device42.com/auto-discovery/remote-collector-rc/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.device42.com/auto-discovery/nmap-autodiscovery/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-41316",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.device42.com/auto-discovery/remote-collector-rc/",
              "refsource": "MISC",
              "url": "https://docs.device42.com/auto-discovery/remote-collector-rc/"
            },
            {
              "name": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/",
              "refsource": "MISC",
              "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01/"
            },
            {
              "name": "https://docs.device42.com/auto-discovery/nmap-autodiscovery/",
              "refsource": "MISC",
              "url": "https://docs.device42.com/auto-discovery/nmap-autodiscovery/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-41316",
    "datePublished": "2021-09-17T14:45:53.000Z",
    "dateReserved": "2021-09-17T00:00:00.000Z",
    "dateUpdated": "2024-08-04T03:08:31.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}