CVE-2022-45166 - Vulnerability Details - OpenCVE

An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used to act on the data returned to the user. It allows a basic user to access data unrelated to their role.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Archibus	Archibus Web Central

Configuration 1 [-]

cpe:2.3:a:archibus:archibus_web_central:2022.03.01.107:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://excellium-services.com/cert-xlm-advisory/CVE-2022-45166/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-01-10T00:00:00

Updated: 2024-08-03T14:09:56.515Z

Reserved: 2022-11-11T00:00:00

Link: CVE-2022-45166

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-10T21:15:12.610

Modified: 2024-11-21T07:28:52.643

Link: CVE-2022-45166

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:archibus:archibus_web_central:2022.03.01.107:*:*:*:*:*:*:*", "matchCriteriaId": "931FD477-1364-4A7E-9C4D-74F1CE19AB6A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used to act on the data returned to the user. It allows a basic user to access data unrelated to their role."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Archibus Web Central 2022.03.01.107. Un servicio expuesto por la aplicaci\u00f3n acepta un conjunto de par\u00e1metros controlados por el usuario que se utilizan para actuar sobre los datos devueltos al usuario. Permite a un usuario b\u00e1sico acceder a datos no relacionados con su funci\u00f3n."}], "id": "CVE-2022-45166", "lastModified": "2024-11-21T07:28:52.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-10T21:15:12.610", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://excellium-services.com/cert-xlm-advisory/CVE-2022-45166/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://excellium-services.com/cert-xlm-advisory/CVE-2022-45166/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}