PT-2022-15189 · Hypr · Hypr Server

Published 2022-07-19 · Updated 2022-07-27 · CVE-2022-2193

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HYPR Server versions prior to 6.14.1

Description The issue is an Insecure Direct Object Reference vulnerability that allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page.

Recommendations For HYPR Server versions prior to 6.14.1, update to version 6.14.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Device Manager page to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-280

Related Identifiers

CVE-2022-2193

Affected Products

Hypr Server

References · 6

• https://osv.dev/vulnerability/CVE-2022-2193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2193 · Security Note
• https://hypr.com/security-advisories · Vendor Advisory
• https://t.me/cvenotify/33403 · Telegram Post
• https://t.me/cvenotify/33822 · Telegram Post
• https://t.me/cibsecurity/46552 · Telegram Post