PT-2022-4457 · Unknown · Workstation

Published 2022-08-23 · Updated 2022-08-29 · CVE-2022-37953

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WorkstationST versions prior to 07.09.15

Description The issue is related to an HTTP response splitting vulnerability in the AM Gateway Challenge-Response dialog of WorkstationST. This vulnerability could allow a remote attacker to compromise a victim's browser or session, potentially affecting the confidentiality and integrity of protected information. The vulnerability is associated with the failure to handle CRLF sequences in HTTP headers. WorkstationST is typically deployed in controlled environments, which increases the complexity of an attack.

Recommendations For WorkstationST versions prior to 07.09.15, update to version 07.09.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the AM Gateway Challenge-Response dialog until a patch is applied. Additionally, ensure that the software is deployed and configured according to the recommended security guidelines to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

BDU:2022-05322

CVE-2022-37953

Affected Products

Workstation

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-37953 · Security Note
• https://bdu.fstec.ru/vul/2022-05322 · Security Note
• https://ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Response_Splitting.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37953 · Vendor Advisory
• https://t.me/cibsecurity/48810 · Telegram Post