CVE-2022-1400 HIGH

CVE-2022-1400: Hardcoded encryption key IV in Exago WebReportsApi.dll

Vendor Device42
Product CMDB
Weakness CWE-321
Published August 16, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.

Key dates

02Disclosure timeline

August 16, 2022 CVE published
September 16, 2024 Record updated