PT-2022-20975 · Marval · Marval Msm

Published 2022-06-28 · Updated 2022-07-08 · CVE-2022-31887

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Marval MSM version 14.19.0.12476

Description The issue allows an attacker to change any user's password in the organization, potentially leading to privilege escalation by changing the administrator password. This is a 0-Click Account Takeover vulnerability.

Recommendations For Marval MSM version 14.19.0.12476, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-31887

Affected Products

Marval Msm

References · 7

• 🔥 https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/0-click-account-takeover · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31887 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31887 · Vendor Advisory
• https://drive.google.com/drive/folders/12nb9KvckzhUNv4RtjlaeZi8QeFqwvkMX?usp=sharing · Note
• https://t.me/cibsecurity/45343 · Telegram Post
• https://marvalglobal.com · Note
• https://t.me/cvenotify/32763 · Telegram Post