PT-2022-3231 · Unknown · Edgexfoundry

Eb-Oss · Published 2022-06-14 · Updated 2024-08-21 · CVE-2022-31066

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions EdgeXFoundry versions prior to 2.1.1

Description The /api/v2/config endpoint exposes message bus credentials to local unauthenticated users, bypassing access controls on message bus credentials when running in security-enabled mode. This allows attackers to intercept data or inject fake data into the EdgeX message bus.

Recommendations For EdgeXFoundry versions prior to 2.1.1, upgrade to EdgeXFoundry Kamakura release (2.2.0) or to the June 2022 EdgeXFoundry LTS Jakarta release (2.1.1) to receive a patch. As a temporary workaround, consider restricting access to the /api/v2/config endpoint until a patch is available. For specific go modules, docker containers, and snaps, refer to the GitHub Security Advisory for patch information.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2022-03934

CVE-2022-31066

GHSA-G63H-Q855-VP3Q

GO-2022-0491

Affected Products

Edgexfoundry

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31066.json · Exploit
• https://github.com/edgexfoundry/edgex-go/pull/4016 · Patch
• https://github.com/edgexfoundry/device-sdk-go/pull/1161 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31066 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31066 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03934 · Security Note
• https://osv.dev/vulnerability/GHSA-g63h-q855-vp3q · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0491 · Vendor Advisory
• https://github.com/edgexfoundry/edgex-go/security/advisories/GHSA-g63h-q855-vp3q · Note
• https://github.com/edgexfoundry/edgex-go · Note
• https://t.me/cvenotify/31615 · Telegram Post
• https://github.com/advisories/GHSA-g63h-q855-vp3q · Note