« Volver al listado

CVE-2022-41324

Estado: AplazadaMedia (6.5)—

Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Northern.tech — MenderAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-41324",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-41324",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-15T18:22:02.100553Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-20T17:15:50.020",
  "references": [
    {
      "url": "https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://northern.tech",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://northern.tech",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information."
    },
    {
      "lang": "es",
      "value": "Northern.tech Mender 3.3.x anterior a 3.3.2 y 3.4.x anterior a 3.4.0 tiene un control de acceso incorrecto y permite a los usuarios con pocos privilegios acceso de lectura predeterminado a cierta información confidencial del dispositivo."
    }
  ],
  "lastModified": "2026-06-17T05:03:01.810",
  "sourceIdentifier": "cve@mitre.org"
}