PT-2022-15941 · Microsoft+1 · Active Directory+2

Published 2022-06-21 · Updated 2022-06-29 · CVE-2022-23342

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hyland Onbase Application Server versions prior to 20.3.58.1000 Hyland OnBase versions 21.1.1.1000 through 21.1.15.1000

Description The issue allows an attacker to obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the "/mobilebroker/ServiceToBroker.svc/Json/Connect" endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems.

Recommendations For Hyland Onbase Application Server versions prior to 20.3.58.1000, update to version 20.3.58.1000 or later. For Hyland OnBase versions 21.1.1.1000 through 21.1.15.1000, update to a version outside of this range. As a temporary workaround, consider restricting access to the "/mobilebroker/ServiceToBroker.svc/Json/Connect" endpoint until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2022-23342

Affected Products

Active Directory

Hyland Onbase

Hyland Onbase Application Server

References · 6

• 🔥 https://github.com/InitRoot/CVE-2022-23342 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23342 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23342 · Vendor Advisory
• https://community.hyland.com/login?returnUrl=/connect/hyland-research-and-development/security-advisories/username-enumeration-in-onbase · Vendor Advisory
• https://t.me/cibsecurity/44894 · Telegram Post
• https://t.me/cvenotify/31930 · Telegram Post