CVE-2022-25804

Published: Jun 9, 2022Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEY_LOCAL_MACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser.

Affected (1)

Products: Igel: Universal Management Suite

1 product

Universal Management Suite

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Igel Universal Management Suite	Version 6.07.100

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.igel.com/igel-solution-family/universal-management-suite/

Source: cve@mitre.org

ProductVendor Advisory

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.igel.com/igel-solution-family/universal-management-suite/

Source: af854a3a-2127-422b-91ae-364da2661108

ProductVendor Advisory

Timeline

No history available yet.