CVE-2022-1401CWE-863

Insufficient validation of provided paths in Exago WrImageResource.axd

Medium · published August 16, 2022

CVSS v3.1
6.9
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.18853 · 97.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-08-16T23:30Z
EPSS history
Timeline
  • 16 AUG 23:30Z
    Insufficient validation of provided paths in Exago WrImageResource.axd
    cvelistv5