PT-2022-14929 · Mimosa · Mimosa Mmp

Noam Moshe · Published 2022-02-18 · Updated 2022-02-26 · CVE-2022-21215

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mimosa MMP versions prior to v1.0.3 PTP C-series versions prior to v2.8.6.1 PTMP C-series and A5x versions prior to v2.5.4.1

Description This issue could allow an attacker to force the server to create and execute a web request, granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc.

Recommendations For Mimosa MMP versions prior to v1.0.3, update to version v1.0.3 or later. For PTP C-series versions prior to v2.8.6.1, update to version v2.8.6.1 or later. For PTMP C-series and A5x versions prior to v2.5.4.1, update to version v2.5.4.1 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-21215

Affected Products

Mimosa Mmp

References · 5

• https://osv.dev/vulnerability/CVE-2022-21215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21215 · Security Note
• https://t.me/cibsecurity/37720 · Telegram Post
• https://t.me/cvenotify/27423 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-034-02 · Note