CVE-2022-26872 Password reset interception via API

2023-01-3015:55:38

CWE-640

certcc

www.cve.org

cve-2022-26872

password reset

interception

api

ami megarac

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

AMI Megarac Password reset interception via API

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MegaRAC SPx-12",
    "vendor": "AMI",
    "versions": [
      {
        "lessThanOrEqual": "SPx12-Update-6.00",
        "status": "affected",
        "version": "0",
        "versionType": "Custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "MegaRAC SPx-13",
    "vendor": "AMI",
    "versions": [
      {
        "lessThanOrEqual": "SPx13-Update-4.00",
        "status": "affected",
        "version": "0",
        "versionType": "Custom"
      }
    ]
  }
]