PT-2022-7191 · Dapr · Dapr Dashboard

Andrewgogogoo · Published 2022-10-03 · Updated 2024-08-21 · CVE-2022-38817

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dapr Dashboard versions 0.1.0 through 0.10.0

Description The issue is related to Incorrect Access Control in the Dapr Dashboard, which is associated with a lack of authentication for a critical function. This allows attackers to obtain sensitive data. The exploitation of this issue can enable a remote attacker to impact the confidentiality of protected information.

Recommendations For Dapr Dashboard versions 0.1.0 through 0.10.0, consider disabling critical functions that rely on authentication until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation. Avoid using the Dapr Dashboard until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-08995

CVE-2022-38817

GHSA-2W6M-Q946-399R

GO-2022-1033

Affected Products

Dapr Dashboard

References · 9

• 🔥 https://github.com/dapr/dashboard/issues/222 · Exploit
• https://osv.dev/vulnerability/GO-2022-1033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38817 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38817 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08995 · Security Note
• https://osv.dev/vulnerability/GHSA-2w6m-q946-399r · Vendor Advisory
• https://github.com/dapr/dashboard · Note
• https://github.com/advisories/GHSA-2w6m-q946-399r · Note
• https://t.me/cibsecurity/50823 · Telegram Post