CVE-2022-1400

Published Aug 17, 2022

Last updated 2 years ago

CVSS critical 9.8

Overview

Description: Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
Source: cve-requests@bitdefender.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-798
cve-requests@bitdefender.com: CWE-321

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:device42:cmdb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A0128DC2-AA38-4286-B20F-F762E2247356",
            "versionEndExcluding": "18.01.00"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References