PT-2023-14718 · Unknown · Thingsboard

Publicado 2023-03-01 · Atualizado 2025-03-07 · CVE-2022-45608

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThingsBoard version 3.4.1

Description An issue in ThingsBoard allows low privileged attackers to gain escalated privileges and become an Administrator on the web application. The attacker must know the corresponding API's parameter authority : value to accomplish this.

Recommendations For ThingsBoard version 3.4.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the API endpoint that utilizes the authority : value parameter until a patch is available.

Exploit

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2022-45608

Produtos afetados

Thingsboard

Referências · 8

• 🔥 https://outpost24.com/blog/access-control-vulnerability-discovered-in-the-thingsboard-iot-platform · Exploit
• https://t.me/cvenotify/113879 · Publicação no Telegram
• https://t.me/cvenotify/45857 · Publicação no Telegram
• http://thingsboard.com · Nota
• https://t.me/cibsecurity/59241 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45608 · Nota de Segurança
• https://wiki.wizard32.net/en/blog/access-control-vulnerability-ThingsBoard · Nota
• https://osv.dev/vulnerability/CVE-2022-45608 · Aviso do Fabricante