Lucene search

[email protected]NVD:CVE-2022-36170

HistoryAug 19, 2022 - 9:15 p.m.

CVE-2022-36170

2022-08-1921:15:08

CWE-798

[email protected]

web.nvd.nist.gov

mapgis pro igserver

hardcoded credentials

privilege escalation

arbitrary file deletion

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

40.6%

JSON

MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion.

Affected configurations

Nvd

Node

mapgisigserverMatch10.5pro

VendorProductVersionCPE
mapgisigserver10.5cpe:2.3:a:mapgis:igserver:10.5:*:*:*:pro:*:*:*

Vendor	Product	Version	CPE
mapgis	igserver	10.5	cpe:2.3:a:mapgis:igserver:10.5::::pro:::

References

example.com:8082/#/login

github.com/prismbreak/vulnerabilities/issues/2

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

40.6%

JSON

Related for NVD:CVE-2022-36170

prion1 cvelist1 cve1