PT-2023-13435 · A4N · A4N

Alexandre Guldner + 1 · Publicado 2023-02-27 · Atualizado 2025-03-10 · CVE-2022-34908

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions A4N (Aremis 4 Nomad) application version 1.5.0

Description An issue was discovered in the A4N application, which possesses an authentication mechanism. However, some features do not require any token or cookie in a request, allowing an attacker to send a simple HTTP request to the right endpoint and obtain authorization to retrieve application data.

Recommendations For version 1.5.0, consider restricting access to sensitive endpoints until a patch is available, and ensure that all features require proper authentication tokens or cookies in requests. As a temporary workaround, disable any features that do not require authentication to minimize the risk of exploitation.

Correção

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

CVE-2022-34908

Produtos afetados

A4N

Referências · 8

• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34908 · Nota
• https://t.me/cvenotify/45059 · Publicação no Telegram
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-34908 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-34908 · Nota de Segurança
• https://aremis.com/en_GB/welcome · Nota
• https://osv.dev/vulnerability/CVE-2022-34908 · Aviso do Fabricante
• https://t.me/cvenotify/114118 · Publicação no Telegram
• https://t.me/cibsecurity/58938 · Publicação no Telegram