CVE-2022-45227 Information disclosure in n/a
An unauthenticated attacker can download backup files from the web portal due to exposed directory listing, leading to sensitive data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45227?
CVE-2022-45227 is a high-severity vulnerability in n/a, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can be downloaded without any authentication.
Weakness: CWE-552
Which versions are affected by CVE-2022-45227?
It affects 1 product.
Products include Dragino Lg01 Lora Firmware.
How do I fix CVE-2022-45227?
No fix has been published for CVE-2022-45227 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-45227 being exploited?
There is no known exploitation of CVE-2022-45227 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5rqp-847g-v4f2.