PT-2022-17531 · Igel · Igel Universal Management Suite

Nick Nam · Published 2022-06-09 · Updated 2022-06-17 · CVE-2022-25805

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IGEL Universal Management Suite (UMS) version 6.07.100

Description An issue was discovered in the transmission of cleartext LDAP bind credentials by the cmd mgt load mgt tree command, allowing an attacker who can intercept or inspect traffic between an authenticated UMS client and server to compromise those LDAP bind credentials.

Recommendations For IGEL Universal Management Suite (UMS) version 6.07.100, consider disabling the cmd mgt load mgt tree command until a patch is available to prevent the transmission of cleartext LDAP bind credentials. Restrict access to the UMS server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2022-25805

Affected Products

Igel Universal Management Suite

References · 5

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25805 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25805 · Vendor Advisory
• https://igel.com/igel-solution-family/universal-management-suite · Vendor Advisory
• https://t.me/cibsecurity/44076 · Telegram Post