PT-2022-20971 · Marval · Marval Msm

Published 2022-06-28 · Updated 2022-07-14 · CVE-2022-31883

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Marval MSM version 14.19.0.12476

Description The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability. This allows a low-privilege user to access other users' API keys, including those of administrators.

Recommendations For Marval MSM version 14.19.0.12476, consider restricting access to API keys to prevent unauthorized viewing, especially for low-privilege users, until a patch is available. As a temporary workaround, limit the visibility of API keys to only those who need them, and avoid using the vulnerable API endpoint that allows low-privilege users to see other users' API keys.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-31883

Affected Products

Marval Msm

References · 6

• https://osv.dev/vulnerability/CVE-2022-31883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31883 · Security Note
• https://marvalglobal.com · Vendor Advisory
• https://drive.google.com/drive/folders/17Q8ItseCzj5W7wlD6ZFqL0y1N5Emxz4_?usp=sharing · Note
• https://t.me/cibsecurity/45339 · Telegram Post
• https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/idor-leads-to-unauthorized-access-to-api-keys · Note