PT-2022-27316 · Unknown · Object First Ootbi Beta

Published 2022-11-07 · Updated 2025-06-24 · CVE-2022-44796

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Object First Ootbi BETA versions 1.0.7.712 through 1.0.13.1610

Description An issue was discovered in the authorization service, allowing access to the Web UI without knowing credentials. The JWT token uses a secret key generated through a function that doesn't produce cryptographically strong sequences, making it predictable for attackers to generate a JWT token and gain access to the Web UI.

Recommendations For versions 1.0.7.712 through 1.0.13.1610, update to version 1.0.13.1611 to resolve the issue. As a temporary workaround, consider restricting access to the Web UI until the update is applied.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2022-44796

Affected Products

Object First Ootbi Beta

References · 6

• https://objectfirst.com/security/of-20221024-0002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44796 · Security Note
• https://t.me/cvenotify/37150 · Telegram Post
• https://t.me/cvenotify/37249 · Telegram Post
• https://t.me/cvenotify/126561 · Telegram Post