PT-2023-15506 · Jedox · Jedox

CVE-2022-47874 · Publicado 2023-05-02 · Atualizado 2025-01-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jedox versions 2020.2.5

Description The issue allows remote authenticated users to view details of database connections via the class com.jedox.etl.mngr.Connections and the method getGlobalConnection() in the /tc/rpc endpoint.

Recommendations For version 2020.2.5, consider restricting access to the getGlobalConnection() method in the com.jedox.etl.mngr.Connections class to prevent unauthorized viewing of database connection details. As a temporary workaround, consider disabling the /tc/rpc endpoint until a patch is available.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2022-47874

Produtos afetados

Jedox

Referências · 7

• 🔥 https://exploit-db.com/exploits/51428 · Exploit
• 🔥 https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf · Exploit
• 🔥 http://packetstormsecurity.com/files/172156/Jedox-2020.2.5-Database-Credential-Disclosure.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-47874 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-47874 · Nota de Segurança
• https://t.me/cvenotify/109189 · Publicação no Telegram
• https://t.me/cibsecurity/63178 · Publicação no Telegram