CVE-2022-25508 Improper Authentication in FreeTAKServer
Unauthenticated attackers can cause denial of service or inject false routes in FreeTAKServer due to missing access controls on route creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25508?
CVE-2022-25508 is a high-severity missing authorization vulnerability in n/a, published on 10 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.
Weakness: CWE-306
Which versions are affected by CVE-2022-25508?
3 open source packages ship an affected version, including freetakserver and FreeTAKServer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
freetakserver PyPI | All versions | None |
freetakserver PyPI | All versions | 1.9.8.5 |
FreeTAKServer PyPI | All versions | 1.9.8.5 |
Products include Freetakserver-Ui Project Freetakserver-Ui.
How do I fix CVE-2022-25508?
Upgrade freetakserver to 1.9.8.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-25508 being exploited?
There is no known exploitation of CVE-2022-25508 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-25510 Hard coded credentials in FreeTAKServer
- CVE-2022-25512 Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
- CVE-2022-25506 SQL Injection in FreeTAKServer-UI
- CVE-2022-25511 Path traversal in FreeTAKServer-UI
- CVE-2022-25507 Cross-site Scripting in FreeTAKServer-UI
Sources
Also known as GHSA-hggv-mcp4-vxc5, PYSEC-2022-43054.