PT-2022-12244 · Delta Rm · Delta Rm

Renato Cruz · Published 2022-01-18 · Updated 2022-07-12 · CVE-2021-44840

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Delta RM version 1.2

Description An issue was discovered in Delta RM, allowing an attacker with a privileged account to edit, create, and delete risk labels, including Criticality and Priority Indication labels. This can be achieved by using the "/core/table/query" endpoint with a POST request, specifying the affected label with the tableUid parameter and the operation with datas[query]. The vulnerable labels include Priority Indication, Quality Evaluation, Progress Margin, and Priority. Additionally, it is possible to export Criticality labels with an unprivileged user.

Recommendations For Delta RM version 1.2, consider restricting access to the "/core/table/query" endpoint to prevent unauthorized modifications to risk labels. As a temporary workaround, limit the use of the tableUid parameter and datas[query] to minimize the risk of exploitation. Avoid using the tableUid parameter and datas[query] with unprivileged users to prevent the export of Criticality labels. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-44840

Affected Products

Delta Rm

References · 6

• 🔥 https://gist.github.com/rntcruz23/81f83f9e406198b08ab40ffae8336a92 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44840 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44840 · Vendor Advisory
• https://deltarm.com · Vendor Advisory
• https://t.me/cibsecurity/35740 · Telegram Post
• https://t.me/cvenotify/25620 · Telegram Post