Lucene search

MitreCVE-2022-39811

HistoryJan 27, 2023 - 10:15 p.m.

CVE-2022-39811

2023-01-2722:15:08

CWE-862

mitre

web.nvd.nist.gov

italtel

netmatch-s

access control

bypass

cve-2022-39811

nvd

security vulnerability

it security

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

56.3%

JSON

Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).

Affected configurations

Nvd

Node

italtelnetmatch-s_ciMatch5.2.0-20211008

VendorProductVersionCPE
italtelnetmatch-s_ci5.2.0-20211008cpe:2.3:a:italtel:netmatch-s_ci:5.2.0-20211008:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
italtel	netmatch-s_ci	5.2.0-20211008	cpe:2.3:a:italtel:netmatch-s_ci:5.2.0-20211008:::::::*

References

www.gruppotim.it/it/footer/red-team.html

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

56.3%

JSON

Related for CVE-2022-39811