CVE-2022-22282 - OpenCVE

SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Sonicwall	Sma 6200 Sma 7210 Firmware Sma 7210 Sma 6210 Sma 6200 Firmware Sma 6210 Firmware Sma 8000v Firmware Sma 8000v Sma 7200 Firmware Sma 7200

Configuration 1 [-]

AND

OR	cpe:2.3:o:sonicwall:sma_6200_firmware:12.4.0:::::::*
	cpe:2.3:o:sonicwall:sma_6200_firmware:12.4.1:::::::*

cpe:2.3:h:sonicwall:sma_6200:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:sonicwall:sma_6210_firmware:12.4.0:::::::*
	cpe:2.3:o:sonicwall:sma_6210_firmware:12.4.1:::::::*

cpe:2.3:h:sonicwall:sma_6210:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:sonicwall:sma_7200_firmware:12.4.0:::::::*
	cpe:2.3:o:sonicwall:sma_7200_firmware:12.4.1:::::::*

cpe:2.3:h:sonicwall:sma_7200:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

OR	cpe:2.3:o:sonicwall:sma_7210_firmware:12.4.0:::::::*
	cpe:2.3:o:sonicwall:sma_7210_firmware:12.4.1:::::::*

cpe:2.3:h:sonicwall:sma_7210:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

OR	cpe:2.3:o:sonicwall:sma_8000v_firmware:12.4.0:::::::*
	cpe:2.3:o:sonicwall:sma_8000v_firmware:12.4.1:::::::*

cpe:2.3:h:sonicwall:sma_8000v:-:*:*:*:*:*:*:*

References

Link	Resource
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: sonicwall

Published: 2022-05-13T19:40:18

Updated: 2022-05-13T19:40:18

Reserved: 2021-12-29T00:00:00

Link: CVE-2022-22282

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-05-13T20:15:08.133

Modified: 2023-06-27T19:00:12.037

Link: CVE-2022-22282

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sma_6200_firmware:12.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "17505971-4213-4CD8-BFCA-C2709ED1D7A8", "vulnerable": true}, {"criteria": "cpe:2.3:o:sonicwall:sma_6200_firmware:12.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "3AD1484C-6DC2-40E8-A423-391F75809A07", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:sma_6200:-:*:*:*:*:*:*:*", "matchCriteriaId": "17BDC1B0-BE6A-4680-A78E-5338AD709095", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sma_6210_firmware:12.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "9CAF7029-6661-4935-BFF5-DAF27B8D63A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:sonicwall:sma_6210_firmware:12.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "8183E157-625A-4503-B40A-9CF007B8D764", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:sma_6210:-:*:*:*:*:*:*:*", "matchCriteriaId": "0734D1E1-2F59-4832-875F-AB03994B8992", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sma_7200_firmware:12.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "43F5B5E9-BB13-4222-816D-961EEE2F05A4", "vulnerable": true}, {"criteria": "cpe:2.3:o:sonicwall:sma_7200_firmware:12.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "6988E176-25D8-42E8-918F-E0C8BD5AC41D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:sma_7200:-:*:*:*:*:*:*:*", "matchCriteriaId": "4C366A02-074C-4F98-AE68-30E0FF85CD00", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sma_7210_firmware:12.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "311646FD-B277-450D-8B15-00E38A181794", "vulnerable": true}, {"criteria": "cpe:2.3:o:sonicwall:sma_7210_firmware:12.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "5D114762-179F-42A3-A3D5-07F288EA1A39", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:sma_7210:-:*:*:*:*:*:*:*", "matchCriteriaId": "A15BA659-19D1-49AA-B249-EAE5E63B9B9A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sma_8000v_firmware:12.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "BDBA4EA4-361A-42F2-B58E-D2327E3FB7D9", "vulnerable": true}, {"criteria": "cpe:2.3:o:sonicwall:sma_8000v_firmware:12.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "806B901C-82C1-4C5F-8C90-0A324F1B676E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:sma_8000v:-:*:*:*:*:*:*:*", "matchCriteriaId": "83EBB751-21AF-4B5F-BB6D-A18FC760781F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability."}, {"lang": "es", "value": "El firmware de la serie SonicWall SMA1000 versiones 12.4.0, 12.4.1-02965 y versiones anteriores, restringe incorrectamente el acceso a un recurso mediante conexiones HTTP de un actor no autorizado, conllevando a una vulnerabilidad de control de acceso inapropiado"}], "id": "CVE-2022-22282", "lastModified": "2023-06-27T19:00:12.037", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-13T20:15:08.133", "references": [{"source": "PSIRT@sonicwall.com", "tags": ["Vendor Advisory"], "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009"}], "sourceIdentifier": "PSIRT@sonicwall.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "PSIRT@sonicwall.com", "type": "Secondary"}]}