PT-2022-15705 · Homer-App · Homer-App

Published 2022-01-09 · Updated 2022-01-18 · CVE-2022-22845

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions homer-app versions prior to 1.4.28 for HOMER 7.x

Description The issue concerns the use of the same JWT secret key across different customers' installations. This could potentially allow unauthorized access.

Recommendations For versions prior to 1.4.28, update to version 1.4.28 or later to resolve the issue. As a temporary workaround, consider regenerating a unique JWT secret key for each installation until the update can be applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-22845

Affected Products

Homer-App

References · 6

• https://github.com/sipcapture/homer-app/compare/1.4.27...1.4.28 · Patch
• https://github.com/sipcapture/homer-app/commit/7f92f3afc8b0380c14af3d0fc1c365318a2d1591 · Patch
• http://sipcapture.org · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22845 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22845 · Vendor Advisory
• https://github.com/sipcapture/homer · Note