{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2022-2752", "assignerOrgId": "f2815942-3388-4c08-ba09-6c15850fda90", "state": "PUBLISHED", "assignerShortName": "Secomea", "requesterUserId": "44bd1e71-3702-434c-b36b-c1ac3bb0bab6", "dateReserved": "2022-08-10T09:43:33.129Z", "datePublished": "2022-12-09T13:30:26.346Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GateManager", "vendor": "Secomea", "versions": [{"lessThan": "10.0", "status": "affected", "version": "9.4", "versionType": "custom"}]}], "datePublic": "2022-12-09T11:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.</div><div>This issue affects:</div><div>Secomea GateManager versions from 9.4 through 9.7.</div><br>"}], "value": "A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.\n\nThis issue affects:\n\nSecomea GateManager versions from 9.4 through 9.7.\n\n\n"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2815942-3388-4c08-ba09-6c15850fda90", "shortName": "Secomea", "dateUpdated": "2022-12-09T13:30:26.346Z"}, "references": [{"url": "https://www.secomea.com/support/cybersecurity-advisory"}], "source": {"defect": ["RD-5896"], "discovery": "EXTERNAL"}, "title": "Potential vulnerabilities in GM login process", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:secomea:gatemanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E14D902-23AE-4E8E-862D-EC224215827B", "versionEndIncluding": "9.7", "versionStartIncluding": "9.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.\n\nThis issue affects:\n\nSecomea GateManager versions from 9.4 through 9.7.\n\n\n"}, {"lang": "es", "value": "Una vulnerabilidad en el servidor web de Secomea GateManager permite que un usuario local se haga pasar por el usuario anterior en algunas condiciones de inicio de sesi\u00f3n fallidas. Este problema afecta a: Versiones de Secomea GateManager desde la 9.4 hasta la 9.7."}], "id": "CVE-2022-2752", "lastModified": "2023-11-07T03:46:52.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 4.7, "source": "VulnerabilityReporting@secomea.com", "type": "Secondary"}]}, "published": "2022-12-09T14:15:09.893", "references": [{"source": "VulnerabilityReporting@secomea.com", "tags": ["Vendor Advisory"], "url": "https://www.secomea.com/support/cybersecurity-advisory"}], "sourceIdentifier": "VulnerabilityReporting@secomea.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "VulnerabilityReporting@secomea.com", "type": "Secondary"}]}

{}