PT-2023-14718 · Unknown · Thingsboard

Published 2023-03-01 · Updated 2025-03-07 · CVE-2022-45608

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThingsBoard version 3.4.1

Description An issue in ThingsBoard allows low privileged attackers to gain escalated privileges and become an Administrator on the web application. The attacker must know the corresponding API's parameter authority : value to accomplish this.

Recommendations For ThingsBoard version 3.4.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the API endpoint that utilizes the authority : value parameter until a patch is available.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-45608

Affected Products

Thingsboard

References · 8

• 🔥 https://outpost24.com/blog/access-control-vulnerability-discovered-in-the-thingsboard-iot-platform · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45608 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45608 · Vendor Advisory
• https://t.me/cvenotify/113879 · Telegram Post
• https://t.me/cvenotify/45857 · Telegram Post
• http://thingsboard.com · Note
• https://t.me/cibsecurity/59241 · Telegram Post
• https://wiki.wizard32.net/en/blog/access-control-vulnerability-ThingsBoard · Note