CVE-2022-1400 Hardcoded encryption key IV in Exago WebReportsApi.dll
Hardcoded encryption keys in Exago Web Reports allow attackers to leak session IDs and elevate privileges in Device42 CMDB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1400?
CVE-2022-1400 is a high-severity vulnerability in Device42 CMDB, published on 16 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
Which versions are affected by CVE-2022-1400?
It affects 1 product.
Products include Device42 Cmdb.
How do I fix CVE-2022-1400?
No fix has been published for CVE-2022-1400 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1400 being exploited?
There is no known exploitation of CVE-2022-1400 in the wild and no public exploit code.
Other vulnerabilities in Device42 CMDB
Sources
Also known as GHSA-355c-6xpw-m767.