CVE-2022-39811

Published Jan 27, 2023

Last updated a year ago

CVSS critical 9.1

Overview

Description: Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:italtel:netmatch-s_ci:5.2.0-20211008:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "59CAE053-D0CC-468D-9795-26575CD63425"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References