CVE-2022-25787

Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. This issue affects: Secomea GateManager all versions prior to 9.7.

CVSS v3 6.7 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.secomea.com/support/cybersecurity-advisory/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_4250:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_4260:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_8250:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:secomea:gatemanager_9250:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-05-04 14:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-25787

Mitre link : CVE-2022-25787

CVE.ORG link : CVE-2022-25787

JSON object : View

Products Affected

secomea

gatemanager_8250_firmware
gatemanager_4260
gatemanager_8250
gatemanager_9250
gatemanager_9250_firmware
gatemanager_4250_firmware
gatemanager_4260_firmware
gatemanager_4250

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-598

Use of GET Request Method With Sensitive Query Strings

{"id": "CVE-2022-25787", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "VulnerabilityReporting@secomea.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}]}, "published": "2022-05-04T14:15:08.583", "references": [{"url": "https://www.secomea.com/support/cybersecurity-advisory/", "tags": ["Vendor Advisory"], "source": "VulnerabilityReporting@secomea.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "VulnerabilityReporting@secomea.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. This issue affects: Secomea GateManager all versions prior to 9.7."}, {"lang": "es", "value": "Una Exposici\u00f3n de Informaci\u00f3n Mediante Cadenas de Consulta en la Petici\u00f3n GET es una vulnerabilidad en la API LMM de Secomea GateManager que permite al administrador del sistema secuestrar la conexi\u00f3n. Este problema afecta a: Secomea GateManager todas las versiones anteriores a 9.7"}], "lastModified": "2022-05-11T19:05:33.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3F34FFF-867B-40A3-9163-E0045B2EE092", "versionEndExcluding": "9.7.622134021"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_4250:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0DB6136A-5440-4980-940D-CD178DC219B8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "106CA21E-663A-4F1D-80AB-47BFC2EF6DBA", "versionEndExcluding": "9.7.622134021"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_4260:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9B546E62-81BB-4ED8-87C9-41BD79484AD0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7EC4241-4AAA-4B94-A024-2533B114723A", "versionEndExcluding": "9.7.622134021"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_8250:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5089C475-2013-4DF6-AD1E-12F576ACAE8E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A93F1AC2-ADD9-43C1-999F-E27FC588411F", "versionEndExcluding": "9.7.622134021"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:secomea:gatemanager_9250:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "68DE2092-2EA1-4D49-84EB-20BE2CD7B113"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "VulnerabilityReporting@secomea.com"}