PT-2022-24254 · Avaya · Avaya Scopia Pathfinder

Published 2022-11-03 · Updated 2024-08-03 · CVE-2022-38168

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4

Description The issue allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification. This is a result of broken access control in user authentication.

Recommendations For Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4, consider restricting access to sensitive information and user password reset functionality until a patch is available. As a temporary workaround, monitor URL modifications to detect potential unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-38168

Affected Products

Avaya Scopia Pathfinder

References · 5

• 🔥 https://medium.com/%40rob_nes/avaya-scopia-pathfinder-broken-access-control-ac792e995bae · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38168 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38168 · Vendor Advisory
• https://t.me/cvenotify/88758 · Telegram Post
• https://t.me/cvenotify/37284 · Telegram Post