PT-2022-17206 · Cerebrate · Cerebrate

Dawid Czarnecki · Published 2022-02-18 · Updated 2023-11-03 · CVE-2022-25318

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cerebrate versions through 1.4

Description An issue was discovered that allowed an unprivileged user to edit and modify sharing groups due to an incorrect sharing group ACL.

Recommendations For versions through 1.4, as a temporary workaround, consider restricting access to sharing group modification features until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-25318

Affected Products

Cerebrate

References · 7

• https://github.com/cerebrate-project/cerebrate/commit/15190b930ebada9e8d294db57c96832799d9d93e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25318 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25318 · Vendor Advisory
• https://t.me/cvenotify/27386 · Telegram Post
• https://t.me/cvenotify/26986 · Telegram Post
• https://zigrin.com/advisories/cerebrate-an-incorrect-sharing-group-acl · Note
• https://t.me/cvenotify/60453 · Telegram Post