Lucene search

NCSC.chCVELIST:CVE-2022-4779

HistoryDec 28, 2022 - 2:20 p.m.

CVE-2022-4779 authentication bypass in elvexys StreamX using StreamView HTML component with public web server feature

2022-12-2814:20:49

NCSC.ch

www.cve.org

authentication bypass

cve-2022-4779

streamx

logic bug

public web server

streamview html

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.6%

JSON

StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme.
StreamX applications using StreamView HTML component with the public web server feature activated are affected.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "StreamX",
    "vendor": "elvexys",
    "versions": [
      {
        "lessThanOrEqual": "6.04.34",
        "status": "affected",
        "version": "6.02.01",
        "versionType": "patch"
      }
    ]
  }
]

References

elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.6%

JSON

Related for CVELIST:CVE-2022-4779