PT-2022-27315 · Firstobject · Object First Ootbi Beta

Published 2022-11-07 · Updated 2025-06-24 · CVE-2022-44795

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Object First Ootbi BETA versions 1.0.7.712 through 1.0.13.1610

Description A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG, allowing prediction of the generated URL. As a result, an attacker can get access to system logs. An attacker would need credentials to exploit this issue.

Recommendations For Object First Ootbi BETA versions 1.0.7.712 through 1.0.13.1610, update to version 1.0.13.1611 to resolve the issue. As a temporary workaround, consider restricting access to system logs until the update is applied.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2022-44795

Affected Products

Object First Ootbi Beta

References · 6

• https://osv.dev/vulnerability/CVE-2022-44795 · Vendor Advisory
• https://objectfirst.com/security/of-20221024-0003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44795 · Security Note
• https://t.me/cvenotify/37151 · Telegram Post
• https://t.me/cvenotify/37250 · Telegram Post
• https://t.me/cvenotify/126560 · Telegram Post