PT-2022-23241 · Unknown · Mapgis 10.5 Pro Igserver

Published 2022-08-19 · Updated 2022-08-23 · CVE-2022-36170

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MapGIS 10.5 Pro IGServer version 10.5

Description The issue is related to hardcoded credentials in the front-end of the software, which can lead to escalation of privileges and arbitrary file deletion.

Recommendations For MapGIS 10.5 Pro IGServer version 10.5, consider removing or modifying the hardcoded credentials in the front-end to prevent exploitation. As a temporary workaround, restrict access to sensitive areas of the software to minimize the risk of privilege escalation and file deletion.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-36170

Affected Products

Mapgis 10.5 Pro Igserver

References · 6

• 🔥 https://github.com/prismbreak/vulnerabilities/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36170 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36170 · Vendor Advisory
• https://t.me/cibsecurity/48460 · Telegram Post
• https://t.me/cvenotify/34997 · Telegram Post
• http://example.com:8082/#/login · Note