PT-2022-20972 · Marval · Marval Msm

Published 2022-06-28 · Updated 2023-08-08 · CVE-2022-31884

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Marval MSM version 14.19.0.12476

Description The issue allows a low privilege user to delete other users' API Keys, including those of high privilege and the Administrator users. This is due to an Improper Access Control vulnerability.

Recommendations For Marval MSM version 14.19.0.12476, consider restricting access to API Key management functions to prevent low privilege users from deleting other users' API Keys until a patch is available. As a temporary workaround, limit the privileges of low-level users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-31884

Affected Products

Marval Msm

References · 8

• 🔥 https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/unauthorized-delete-add-api-users-api-keys · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31884 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31884 · Vendor Advisory
• https://t.me/cvenotify/32762 · Telegram Post
• https://t.me/cibsecurity/45342 · Telegram Post
• https://drive.google.com/drive/folders/1lFM9cVUqTlKyDI2azmI1rIF4HoZBt_4i?usp=sharing · Note
• https://marvalglobal.com · Note
• https://t.me/cvenotify/32327 · Telegram Post