CVE-2022-25780 - OpenCVE

Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Secomea	Gatemanager 4250 Gatemanager 4250 Firmware Gatemanager 4260 Gatemanager 4260 Firmware Gatemanager 8250 Gatemanager 8250 Firmware Gatemanager 9250 Gatemanager 9250 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_4250:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_4260:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_8250:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_9250:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.secomea.com/support/cybersecurity-advisory/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Secomea

Published: 2022-05-04T13:52:15

Updated: 2024-08-03T04:49:43.496Z

Reserved: 2022-02-22T00:00:00

Link: CVE-2022-25780

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-05-04T14:15:08.207

Modified: 2022-05-11T18:48:20.910

Link: CVE-2022-25780

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "GateManager", "vendor": "Secomea", "versions": [{"lessThan": "9.7", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-04T13:52:15", "orgId": "f2815942-3388-4c08-ba09-6c15850fda90", "shortName": "Secomea"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.secomea.com/support/cybersecurity-advisory/"}], "source": {"defect": ["RD-5310"], "discovery": "INTERNAL"}, "title": "Information leak via device availability query function", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "VulnerabilityReporting@secomea.com", "ID": "CVE-2022-25780", "STATE": "PUBLIC", "TITLE": "Information leak via device availability query function"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GateManager", "version": {"version_data": [{"version_affected": "<", "version_value": "9.7"}]}}]}, "vendor_name": "Secomea"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Exposure"}]}]}, "references": {"reference_data": [{"name": "https://www.secomea.com/support/cybersecurity-advisory/", "refsource": "MISC", "url": "https://www.secomea.com/support/cybersecurity-advisory/"}]}, "source": {"defect": ["RD-5310"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:49:43.496Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.secomea.com/support/cybersecurity-advisory/"}]}]}, "cveMetadata": {"assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90", "assignerShortName": "Secomea", "cveId": "CVE-2022-25780", "datePublished": "2022-05-04T13:52:15", "dateReserved": "2022-02-22T00:00:00", "dateUpdated": "2024-08-03T04:49:43.496Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3F34FFF-867B-40A3-9163-E0045B2EE092", "versionEndExcluding": "9.7.622134021", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_4250:-:*:*:*:*:*:*:*", "matchCriteriaId": "0DB6136A-5440-4980-940D-CD178DC219B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "106CA21E-663A-4F1D-80AB-47BFC2EF6DBA", "versionEndExcluding": "9.7.622134021", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_4260:-:*:*:*:*:*:*:*", "matchCriteriaId": "9B546E62-81BB-4ED8-87C9-41BD79484AD0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7EC4241-4AAA-4B94-A024-2533B114723A", "versionEndExcluding": "9.7.622134021", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_8250:-:*:*:*:*:*:*:*", "matchCriteriaId": "5089C475-2013-4DF6-AD1E-12F576ACAE8E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A93F1AC2-ADD9-43C1-999F-E27FC588411F", "versionEndExcluding": "9.7.622134021", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_9250:-:*:*:*:*:*:*:*", "matchCriteriaId": "68DE2092-2EA1-4D49-84EB-20BE2CD7B113", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope."}, {"lang": "es", "value": "Una vulnerabilidad de exposici\u00f3n de informaci\u00f3n en la Interfaz de Usuario Web de Secomea GateManager permite al usuario que ha iniciado la sesi\u00f3n consultar dispositivos fuera de su \u00e1mbito"}], "id": "CVE-2022-25780", "lastModified": "2022-05-11T18:48:20.910", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "VulnerabilityReporting@secomea.com", "type": "Secondary"}]}, "published": "2022-05-04T14:15:08.207", "references": [{"source": "VulnerabilityReporting@secomea.com", "tags": ["Vendor Advisory"], "url": "https://www.secomea.com/support/cybersecurity-advisory/"}], "sourceIdentifier": "VulnerabilityReporting@secomea.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "VulnerabilityReporting@secomea.com", "type": "Secondary"}]}