CVE-2022-1401 MEDIUM

CVE-2022-1401: Insufficient validation of provided paths in Exago WrImageResource.axd

Vendor Device42
Product CMDB
Weakness CWE-863 · Incorrect authorization
Published August 16, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00.

Key dates

02Disclosure timeline

August 16, 2022 CVE published
September 17, 2024 Record updated