CVE-2022-21215 Information

Description

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms accessing secret keys changing configurations etc. Affecting MMP: All versions prior to v1.0.3 PTP C-series: Device versions prior to v2.8.6.1 and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8