CVE-2022-25311CWE-269

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions)

High · published March 8, 2022

CVSS v3.1
7.3
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2022-03-08T00:00Z
EPSS history
Timeline
  • 08 MAR 00:00Z
    A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions)
    cvelistv5