PT-2022-17530 · Igel · Igel Universal Management Suite

Nick Nam · Published 2022-06-09 · Updated 2022-06-17 · CVE-2022-25804

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IGEL Universal Management Suite version 6.07.100

Description An issue was discovered in the IGEL Universal Management Suite (UMS) that allows an unprivileged local attacker to read encrypted database user and password values for the UMS superuser due to insecure permissions for the serverconfig registry key under JavaSoftPrefsdeigelrmconfig in HKEY LOCAL MACHINESOFTWARE.

Recommendations For IGEL Universal Management Suite version 6.07.100, consider restricting access to the serverconfig registry key to prevent unauthorized reading of the encrypted dbuser and dbpassword values. As a temporary workaround, review and adjust the permissions of the serverconfig registry key to ensure that only authorized users have access to it.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-25804

Affected Products

Igel Universal Management Suite

References · 5

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25804 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25804 · Vendor Advisory
• https://igel.com/igel-solution-family/universal-management-suite · Vendor Advisory
• https://t.me/cibsecurity/44067 · Telegram Post