Lucene search

MitreCVE-2022-36170

HistoryAug 19, 2022 - 9:15 p.m.

CVE-2022-36170

2022-08-1921:15:08

CWE-798

mitre

web.nvd.nist.gov

cve-2022-36170

mapgis

igserver

hardcoded credentials

privilege escalation

file deletion

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion.

Affected configurations

Nvd

Node

mapgisigserverMatch10.5pro

VendorProductVersionCPE
mapgisigserver10.5cpe:2.3:a:mapgis:igserver:10.5:*:*:*:pro:*:*:*

Vendor	Product	Version	CPE
mapgis	igserver	10.5	cpe:2.3:a:mapgis:igserver:10.5::::pro:::

References

example.com:8082/#/login

github.com/prismbreak/vulnerabilities/issues/2

Social References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

Related for CVE-2022-36170