CVE-2022-3229 - Because the web management interface for Unified Intents' Unified Remote solution does not itself re

CVE-2022-3229

Summary

Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.

References

https://github.com/rapid7/metasploit-framework/pull/16989

Vulnerable Configurations

cpe:2.3:a:unifiedremote:unified_remote:*:*:*:*:*:*:*:*
cpe:2.3:a:unifiedremote:unified_remote:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

CVSS

Base:	None
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication

Impact

Confidentiality	Integrity	Availability

Last major update

15-02-2023 - 16:24

Published

06-02-2023 - 23:15

Last modified

15-02-2023 - 16:24