CVE-2021-32958CWE-288

Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel

Medium · published May 23, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

Successful exploitation of this vulnerability on Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface (UI). With access to the web UI an attacker can access assets managed by the SRA installation and could compromise the installation.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2022-05-23T19:34Z
EPSS history
Timeline
  • 23 MAY 19:34Z
    Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel
    cvelistv5