« Volver al listado

CVE-2022-21828

Estado: ModificadaAlta (7.2)—

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ivanti — Incapptic Connect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-21828",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Ivanti Incapptic Connect",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in version 1.40.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-04T17:15:07.897",
  "references": [
    {
      "url": "https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3."
    },
    {
      "lang": "es",
      "value": "Un usuario con acceso de alto privilegio a la consola web de Incapptic Connect puede ejecutar código de forma remota en el servidor de Incapptic Connect usando un vector de ataque no especificado en las versiones de Incapptic Connect versiones 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 y 1.35.3"
    }
  ],
  "lastModified": "2026-06-17T04:27:03.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.35.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84D66A38-99B0-4D11-B537-1365427A2B8E"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.35.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7620D67A-3F0A-47B5-9A8E-ABB74F5811B6"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.35.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "664E657A-47AB-47EA-B123-DE8FB27F3324"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.36.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2769912-EE72-4F82-A965-38FB85D249D6"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.37.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A62F84DF-87AE-4747-8BC5-13DDF5D304F6"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.37.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32126789-6BF1-4FC0-B419-0E9978F5C646"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.38.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5943C9D-5329-45EF-AF66-59AD34D157B3"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.38.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B30CC96E-0351-47A2-A076-9BDA9D41298F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.39.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55A30D9B-927D-4F0B-B6CC-A9BF07150381"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.39.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37C09E2C-4859-4A4B-A136-8CC46376CF3A"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:incapptic_connect:1.40.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D46B01F3-E9AE-4C2A-AD8D-28FFF049F7AE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}