PT-2022-19907 · Fabasoft · Fabasoft Cloud Enterprise Client

Tino Kautschke · Published 2022-09-19 · Updated 2023-08-08 · CVE-2022-29908

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fabasoft Cloud Enterprise Client version 22.4.0043

Description The issue concerns the folioupdate service, which allows Local Privilege Escalation.

Recommendations For Fabasoft Cloud Enterprise Client version 22.4.0043, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-29908

Affected Products

Fabasoft Cloud Enterprise Client

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-29908 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29908 · Vendor Advisory
• https://help.cloud.fabasoft.com/index.php?topic=doc/Technical-Information-eng/the-fabasoft-cloud-enterprise-client.htm · Note
• https://t.me/cibsecurity/50061 · Telegram Post
• https://compass-security.com/fileadmin/Research/Advisories/2022_13_CSNC-2022-010_LPE_Cloud_Client.txt · Note