PT-2022-15519 · Dell Emc · Dell Emc Appsync

Published 2022-01-21 · Updated 2022-01-27 · CVE-2022-22551

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DELL EMC AppSync versions 3.9 to 4.3

Description The issue concerns the use of GET request methods with sensitive query strings, potentially allowing an adjacent, unauthenticated attacker to exploit this and hijack the victim's session.

Recommendations For DELL EMC AppSync versions 3.9 to 4.3, consider restricting access to sensitive query strings in GET requests as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-598

CWE-384

Related Identifiers

CVE-2022-22551

Affected Products

Dell Emc Appsync

References · 4

• https://osv.dev/vulnerability/CVE-2022-22551 · Vendor Advisory
• https://dell.com/support/kbdoc/000195377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22551 · Security Note
• https://t.me/cibsecurity/36078 · Telegram Post