PT-2024-11640 · Mender · Mender

Ole Herman S. Elgesem · Published 2024-06-20 · Updated 2024-06-21 · CVE-2022-41324

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mender versions 3.3.x through 3.3.1 Mender versions 3.4.x through 3.3.9 is not needed, since 3.4.0 is the fixed version, so we can say Mender versions 3.3.x through 3.3.1 and 3.4.x before 3.4.0 can be simplified to Mender versions 3.3.x through 3.3.1 and 3.4.x before 3.4.0

However, since 3.3.2 is the fixed version for 3.3.x, we can simplify to Mender versions 3.3.x through 3.3.1 Mender versions 3.4.x before 3.4.0

Description The issue is related to Incorrect Access Control, allowing low-privileged users default read access to some sensitive device information.

Recommendations For Mender versions 3.3.x through 3.3.1, update to version 3.3.2 or later. For Mender versions 3.4.x before 3.4.0, update to version 3.4.0 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-41324

Affected Products

Mender

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-41324 · Security Note
• https://t.me/cvenotify/83998 · Telegram Post
• https://twitter.com/CVEnew/status/1803830630536618309 · Twitter Post
• https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users · Note
• https://t.me/cvenotify/83878 · Telegram Post
• https://northern.tech · Note
• https://t.me/cvenotify/83877 · Telegram Post
• https://t.me/cvenotify/83997 · Telegram Post