CVE-2022-25804

· MEDIUMModified

← All CVEs

CVSS v3.1

5.5

EPSS

0.28%

Published

Jun 9, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEY_LOCAL_MACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-276

Affected Products (1)

igel · universal_management_suitevulnerable

References (4)

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md

ExploitThird Party Advisory

https://www.igel.com/igel-solution-family/universal-management-suite/

ProductVendor Advisory

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md

ExploitThird Party Advisory

https://www.igel.com/igel-solution-family/universal-management-suite/

ProductVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs