CVE-2022-24414CWE-598

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests

High · published May 26, 2022

CVSS v3.1
7.6
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00647 · 50.4th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2022-05-26T15:20Z
EPSS history
Timeline
  • 26 MAY 15:20Z
    Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests
    cvelistv5