Lucene search

MitreCVE-2022-38599

HistoryDec 08, 2022 - 5:15 p.m.

CVE-2022-38599

2022-12-0817:15:10

CWE-668

mitre

web.nvd.nist.gov

cve-2022-38599

teleport

information leak

web interface

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

32.9%

JSON

Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.

Affected configurations

Nvd

Node

goteleportteleportMatch3.2.2

goteleportteleportMatch3.5.6rc6

goteleportteleportMatch3.6.3beta2

VendorProductVersionCPE
goteleportteleport3.2.2cpe:2.3:a:goteleport:teleport:3.2.2:*:*:*:*:*:*:*
goteleportteleport3.5.6cpe:2.3:a:goteleport:teleport:3.5.6:rc6:*:*:*:*:*:*
goteleportteleport3.6.3cpe:2.3:a:goteleport:teleport:3.6.3:beta2:*:*:*:*:*:*

Vendor	Product	Version	CPE
goteleport	teleport	3.2.2	cpe:2.3:a:goteleport:teleport:3.2.2:::::::*
goteleport	teleport	3.5.6	cpe:2.3:a:goteleport:teleport:3.5.6:rc6::::::
goteleport	teleport	3.6.3	cpe:2.3:a:goteleport:teleport:3.6.3:beta2::::::

References

teleport.com

gist.github.com/arleyna/20d858e11c48984d00926fa8cc0c2722

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

32.9%

JSON

Related for CVE-2022-38599