9.4

CVE-2022-26833

Exploit
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openautomationsoftware ≫ Oas Platform Version 16.00.0112
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 37.64% 0.984
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.4 3.9 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Cisco Talos 9.4 3.9 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1513
Third Party Advisory
Exploit
Mitigation