PT-2022-17207 · Cerebrate · Cerebrate

Dawid · Published 2022-02-18 · Updated 2023-12-21 · CVE-2022-25319

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cerebrate versions through 1.4

Description An issue was discovered where endpoints could be open even when not enabled.

Recommendations For versions through 1.4, consider disabling endpoints that are not in use to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2022-25319

Affected Products

Cerebrate

References · 8

• 🔥 https://zigrin.com/cakephp-application-cybersecurity-research-forgotten-endpoint-authentication-bypass-with-open-prefix · Exploit
• https://github.com/cerebrate-project/cerebrate/commit/a2632349175e574cd6305fa459cd7610ea09ab61 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25319 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25319 · Vendor Advisory
• https://t.me/cvenotify/27385 · Telegram Post
• https://zigrin.com/advisories/cerebrate-endpoints-could-be-open-when-not-enabled · Note
• https://t.me/cvenotify/26985 · Telegram Post
• https://t.me/cvenotify/64593 · Telegram Post