CVE-2022-46382 Auth bypass in n/a
Deleted users retain valid authentication tokens, allowing them to perform unauthorized actions within Digital Rebar.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-46382?
CVE-2022-46382 is a high-severity authentication bypass vulnerability in n/a, published on 6 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing into Digital Rebar, users are issued authentication tokens tied to their account to perform actions within Digital Rebar. During the validation process of these tokens, Digital Rebar did not check if the user account still exists. Deleted Digital Rebar users could still use their tokens to perform actions within Digital Rebar.
Weakness: CWE-276
Which versions are affected by CVE-2022-46382?
It affects 1 product.
Products include Rackn Digital Rebar.
How do I fix CVE-2022-46382?
No fix has been published for CVE-2022-46382 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-46382 being exploited?
There is no known exploitation of CVE-2022-46382 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qf5h-2qwh-9v97.