CVE-2022-28866

HIGH Year: 2022
CVSS v3 Score
8.8
High
Weakness Type
CWE-862
View all →

Vulnerability Description

Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or editing of) data and functionality in all endpoints under /#settings/* and /api/settings/*. By not verifying the permissions for access to resources, it allows a potential attacker to view pages, with sensitive data, that are not allowed, and modify system configurations also causing DoS, which should be accessed only by user with administration profile, bypassing all controls (without checking for user identity).

Related Vulnerabilities

CVE-2015-8840

HIGH
CVSS:8.8(High)

The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly ha...

CWE-8622015

CVE-2017-17665

HIGH
CVSS:8.8(High)

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a m...

CWE-8622017

CVE-2017-2652

HIGH
CVSS:8.8(High)

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Ove...

CWE-8622017

CVE-2017-5180

HIGH
CVSS:8.8(High)

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users t...

CWE-8622017

CVE-2017-6369

HIGH
CVSS:8.8(High)

Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.

CWE-8622017

CVE-2017-6565

HIGH
CVSS:8.8(High)

On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload files to the server hosting the web service. ...

CWE-8622017