CVE-2022-1400 (GCVE-0-2022-1400)
Vulnerability from cvelistv5 – Published: 2022-08-16 23:25 – Updated: 2024-09-16 22:36
VLAI?
Title
Hardcoded encryption key IV in Exago WebReportsApi.dll
Summary
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
Severity ?
7.1 (High)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Date Public ?
2022-08-16 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:03:06.249Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CMDB",
"vendor": "Device42",
"versions": [
{
"lessThan": "18.01.00",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
},
{
"lang": "en",
"value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
},
{
"lang": "en",
"value": "Cristian BUZA - Security Engineer @ Bitdefender"
},
{
"lang": "en",
"value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
}
],
"datePublic": "2022-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-16T23:25:12.000Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
}
],
"solutions": [
{
"lang": "en",
"value": "An update to Device42 CMDB version 19.01.00 fixes the issue."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Hardcoded encryption key IV in Exago WebReportsApi.dll",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-requests@bitdefender.com",
"DATE_PUBLIC": "2022-08-16T19:00:00.000Z",
"ID": "CVE-2022-1400",
"STATE": "PUBLIC",
"TITLE": "Hardcoded encryption key IV in Exago WebReportsApi.dll"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CMDB",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "18.01.00"
}
]
}
}
]
},
"vendor_name": "Device42"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
},
{
"lang": "eng",
"value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
},
{
"lang": "eng",
"value": "Cristian BUZA - Security Engineer @ Bitdefender"
},
{
"lang": "eng",
"value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-321 Use of Hard-coded Cryptographic Key"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
"refsource": "MISC",
"url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
}
]
},
"solution": [
{
"lang": "en",
"value": "An update to Device42 CMDB version 19.01.00 fixes the issue."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2022-1400",
"datePublished": "2022-08-16T23:25:12.477Z",
"dateReserved": "2022-04-19T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:36:19.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-1400",
"date": "2026-04-25",
"epss": "0.0038",
"percentile": "0.59529"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:device42:cmdb:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.01.00\", \"matchCriteriaId\": \"A0128DC2-AA38-4286-B20F-F762E2247356\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.\"}, {\"lang\": \"es\", \"value\": \"Un uso de una vulnerabilidad de Clave Criptogr\\u00e1fica Embebida en el archivo WebReportsApi.dll de Exago Web Reports, como es usado en el Device42 Asset Management Appliance, permite a un atacante filtrar los ID de sesi\\u00f3n y elevar privilegios. Este problema afecta: Device42 CMDB versiones anteriores a 18.01.00.\\n\"}]",
"id": "CVE-2022-1400",
"lastModified": "2024-11-21T06:40:39.293",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"cve-requests@bitdefender.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 5.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
"published": "2022-08-17T00:15:08.130",
"references": "[{\"url\": \"https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/\", \"source\": \"cve-requests@bitdefender.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "cve-requests@bitdefender.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"cve-requests@bitdefender.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-321\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-1400\",\"sourceIdentifier\":\"cve-requests@bitdefender.com\",\"published\":\"2022-08-17T00:15:08.130\",\"lastModified\":\"2024-11-21T06:40:39.293\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.\"},{\"lang\":\"es\",\"value\":\"Un uso de una vulnerabilidad de Clave Criptogr\u00e1fica Embebida en el archivo WebReportsApi.dll de Exago Web Reports, como es usado en el Device42 Asset Management Appliance, permite a un atacante filtrar los ID de sesi\u00f3n y elevar privilegios. Este problema afecta: Device42 CMDB versiones anteriores a 18.01.00.\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve-requests@bitdefender.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cve-requests@bitdefender.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-321\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:device42:cmdb:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.01.00\",\"matchCriteriaId\":\"A0128DC2-AA38-4286-B20F-F762E2247356\"}]}]}],\"references\":[{\"url\":\"https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/\",\"source\":\"cve-requests@bitdefender.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…