CVE-2022-29556

2022-04-2819:48:39

mitre

www.cve.org

iot-manager

microservice

ssrf

northern.tech mender enterprise

azure iot hub integration

cross-tenant actions

internal api endpoints

cve-2022-29556

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

60.5%

JSON

The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints.

References

mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect

northern.tech