cvelistv5 - cve-2022-22282

cve-2022-22282

Vulnerability from cvelistv5

Published

2022-05-13 19:40

Modified

2024-08-03 03:07

Severity ?

Summary

SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.

References

▼	URL	Tags
	PSIRT@sonicwall.com	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009	Vendor Advisory

Impacted products

▼	Vendor	Product
	SonicWall	SonicWall SMA1000

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:07:50.319Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SonicWall SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.0"
            },
            {
              "status": "affected",
              "version": "12.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-13T19:40:18",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "PSIRT@sonicwall.com",
          "ID": "CVE-2022-22282",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SonicWall SMA1000",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "12.4.0"
                          },
                          {
                            "version_value": "12.4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SonicWall"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284: Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2022-22282",
    "datePublished": "2022-05-13T19:40:18",
    "dateReserved": "2021-12-29T00:00:00",
    "dateUpdated": "2024-08-03T03:07:50.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-22282\",\"sourceIdentifier\":\"PSIRT@sonicwall.com\",\"published\":\"2022-05-13T20:15:08.133\",\"lastModified\":\"2023-06-27T19:00:12.037\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.\"},{\"lang\":\"es\",\"value\":\"El firmware de la serie SonicWall SMA1000 versiones 12.4.0, 12.4.1-02965 y versiones anteriores, restringe incorrectamente el acceso a un recurso mediante conexiones HTTP de un actor no autorizado, conllevando a una vulnerabilidad de control de acceso inapropiado\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":7.5},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]},{\"source\":\"PSIRT@sonicwall.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_6200_firmware:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"17505971-4213-4CD8-BFCA-C2709ED1D7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_6200_firmware:12.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AD1484C-6DC2-40E8-A423-391F75809A07\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_6200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"17BDC1B0-BE6A-4680-A78E-5338AD709095\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_6210_firmware:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CAF7029-6661-4935-BFF5-DAF27B8D63A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_6210_firmware:12.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8183E157-625A-4503-B40A-9CF007B8D764\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_6210:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0734D1E1-2F59-4832-875F-AB03994B8992\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_7200_firmware:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43F5B5E9-BB13-4222-816D-961EEE2F05A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_7200_firmware:12.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6988E176-25D8-42E8-918F-E0C8BD5AC41D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_7200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C366A02-074C-4F98-AE68-30E0FF85CD00\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_7210_firmware:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"311646FD-B277-450D-8B15-00E38A181794\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_7210_firmware:12.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D114762-179F-42A3-A3D5-07F288EA1A39\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_7210:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A15BA659-19D1-49AA-B249-EAE5E63B9B9A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_8000v_firmware:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDBA4EA4-361A-42F2-B58E-D2327E3FB7D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_8000v_firmware:12.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"806B901C-82C1-4C5F-8C90-0A324F1B676E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_8000v:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83EBB751-21AF-4B5F-BB6D-A18FC760781F\"}]}]}],\"references\":[{\"url\":\"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009\",\"source\":\"PSIRT@sonicwall.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2022-22282

Vulnerability from cvelistv5

ghsa-8xpw-m3x3-rq75

Vulnerability from github

gsd-2022-22282

Vulnerability from gsd

Tags

Sightings

Nomenclature