Common Weakness Enumeration
CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
310 vulnerabilities reference this CWE, most recent first.
CVE-2022-23729 (GCVE-0-2022-23729)
Vulnerability from cvelistv5 – Published: 2022-03-04 15:51 – Updated: 2024-08-03 03:51
VLAI
EPSS
VEX
Summary
When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.
Severity
No CVSS data available.
CWE
- CWE-305 - [CWE-305] Authentication Bypass by Primary Weakness
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://lgsecurity.lge.com/bulletins/mobile | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | LG mobile devices |
Affected:
All up to Android version 11 (Except for Android 11 with mainline applied)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:51:45.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lgsecurity.lge.com/bulletins/mobile"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LG mobile devices",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All up to Android version 11 (Except for Android 11 with mainline applied)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "[CWE-305] Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-04T15:51:14.000Z",
"orgId": "42f21055-226c-4bce-a3c8-ecf55a3551fb",
"shortName": "LGE"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lgsecurity.lge.com/bulletins/mobile"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "product.security@lge.com",
"ID": "CVE-2022-23729",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LG mobile devices",
"version": {
"version_data": [
{
"version_value": "All up to Android version 11 (Except for Android 11 with mainline applied)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "[CWE-305] Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lgsecurity.lge.com/bulletins/mobile",
"refsource": "MISC",
"url": "https://lgsecurity.lge.com/bulletins/mobile"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "42f21055-226c-4bce-a3c8-ecf55a3551fb",
"assignerShortName": "LGE",
"cveId": "CVE-2022-23729",
"datePublished": "2022-03-04T15:51:14.000Z",
"dateReserved": "2022-01-19T00:00:00.000Z",
"dateUpdated": "2024-08-03T03:51:45.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-4722 (GCVE-0-2022-4722)
Vulnerability from cvelistv5 – Published: 2022-12-23 00:00 – Updated: 2025-04-09 20:41
VLAI
EPSS
VEX
Title
Authentication Bypass by Primary Weakness in ikus060/rdiffweb
Summary
Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Severity
7.2 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-09 17:46 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ikus060 | ikus060/rdiffweb |
Affected:
unspecified , < 2.5.5
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:48:40.330Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://huntr.dev/bounties/c62126dc-d9a6-4d3e-988d-967031876c58"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4722",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T17:46:39.206811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-09T20:41:08.079Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ikus060/rdiffweb",
"vendor": "ikus060",
"versions": [
{
"lessThan": "2.5.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-23T00:00:00.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"url": "https://huntr.dev/bounties/c62126dc-d9a6-4d3e-988d-967031876c58"
},
{
"url": "https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837"
}
],
"source": {
"advisory": "c62126dc-d9a6-4d3e-988d-967031876c58",
"discovery": "EXTERNAL"
},
"title": "Authentication Bypass by Primary Weakness in ikus060/rdiffweb"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-4722",
"datePublished": "2022-12-23T00:00:00.000Z",
"dateReserved": "2022-12-23T00:00:00.000Z",
"dateUpdated": "2025-04-09T20:41:08.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3100 (GCVE-0-2022-3100)
Vulnerability from cvelistv5 – Published: 2023-01-18 00:00 – Updated: 2025-04-03 19:26
VLAI
EPSS
VEX
Summary
A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-02 17:55 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Red Hat OpenStack Platform |
Affected:
13.0-17.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:00:10.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2022-3100"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-3100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-02T17:55:00.610784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T19:26:10.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Red Hat OpenStack Platform",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "13.0-17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-18T00:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2022-3100"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2022-3100",
"datePublished": "2023-01-18T00:00:00.000Z",
"dateReserved": "2022-09-02T00:00:00.000Z",
"dateUpdated": "2025-04-03T19:26:10.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2651 (GCVE-0-2022-2651)
Vulnerability from cvelistv5 – Published: 2022-08-04 09:10 – Updated: 2024-08-03 00:46
VLAI
EPSS
VEX
Title
Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm
Summary
Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.
Severity
9.8 (Critical)
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/428eee94-f1a0-45d0-9e2… | x_refsource_CONFIRM |
| https://github.com/bookwyrm-social/bookwyrm/commi… | x_refsource_MISC |
| http://packetstormsecurity.com/files/168423/Bookw… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bookwyrm-social | bookwyrm-social/bookwyrm |
Affected:
unspecified , < 0.4.5
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:46:03.487Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/168423/Bookwyrm-0.4.3-Authentication-Bypass.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "bookwyrm-social/bookwyrm",
"vendor": "bookwyrm-social",
"versions": [
{
"lessThan": "0.4.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-20T15:06:31.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/168423/Bookwyrm-0.4.3-Authentication-Bypass.html"
}
],
"source": {
"advisory": "428eee94-f1a0-45d0-9e25-318641115550",
"discovery": "EXTERNAL"
},
"title": "Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-2651",
"STATE": "PUBLIC",
"TITLE": "Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "bookwyrm-social/bookwyrm",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.4.5"
}
]
}
}
]
},
"vendor_name": "bookwyrm-social"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550"
},
{
"name": "https://github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f",
"refsource": "MISC",
"url": "https://github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f"
},
{
"name": "http://packetstormsecurity.com/files/168423/Bookwyrm-0.4.3-Authentication-Bypass.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/168423/Bookwyrm-0.4.3-Authentication-Bypass.html"
}
]
},
"source": {
"advisory": "428eee94-f1a0-45d0-9e25-318641115550",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-2651",
"datePublished": "2022-08-04T09:10:10.000Z",
"dateReserved": "2022-08-04T00:00:00.000Z",
"dateUpdated": "2024-08-03T00:46:03.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0547 (GCVE-0-2022-0547)
Vulnerability from cvelistv5 – Published: 2022-03-18 18:00 – Updated: 2025-11-03 20:34
VLAI
EPSS
VEX
Summary
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 13:27 UTC
CWE
- CWE-305 - - Authentication Bypass by Primary Weakness
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://community.openvpn.net/openvpn/wiki/Securi… | x_refsource_MISC |
| https://community.openvpn.net/openvpn/wiki/CVE-20… | x_refsource_MISC |
| https://openvpn.net/community-downloads/ | x_refsource_MISC |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.debian.org/debian-lts-announce/2022… | mailing-listx_refsource_MLIST |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:34:30.191Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://openvpn.net/community-downloads/"
},
{
"name": "FEDORA-2022-7d46acce7c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"name": "FEDORA-2022-cb4c1146dc",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-0547",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:27:37.639278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T18:46:01.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenVPN",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "version 2.1 until version 2.4.12 and 2.5.6."
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 - Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T13:06:11.000Z",
"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"shortName": "OpenVPN"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://openvpn.net/community-downloads/"
},
{
"name": "FEDORA-2022-7d46acce7c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"name": "FEDORA-2022-cb4c1146dc",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@openvpn.net",
"ID": "CVE-2022-0547",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenVPN",
"version": {
"version_data": [
{
"version_value": "version 2.1 until version 2.4.12 and 2.5.6."
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 - Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"name": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547",
"refsource": "MISC",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"name": "https://openvpn.net/community-downloads/",
"refsource": "MISC",
"url": "https://openvpn.net/community-downloads/"
},
{
"name": "FEDORA-2022-7d46acce7c",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/"
},
{
"name": "FEDORA-2022-cb4c1146dc",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/"
},
{
"name": "[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e",
"assignerShortName": "OpenVPN",
"cveId": "CVE-2022-0547",
"datePublished": "2022-03-18T18:00:20.000Z",
"dateReserved": "2022-02-08T00:00:00.000Z",
"dateUpdated": "2025-11-03T20:34:30.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-0451 (GCVE-0-2022-0451)
Vulnerability from cvelistv5 – Published: 2022-02-18 13:35 – Updated: 2025-04-21 13:56
VLAI
EPSS
VEX
Title
Auth bypass in Dark SDK
Summary
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-21 13:36 UTC
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://dart-review.googlesource.com/c/sdk/+/229947 | x_refsource_MISC |
| https://github.com/dart-lang/sdk/commit/57db739be… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Google LLC | Dart SDK |
Affected:
unspecified , < 2.16.0
(custom)
|
Date Public
2022-02-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:25:40.615Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dart-review.googlesource.com/c/sdk/+/229947"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-0451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-21T13:36:05.316828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-21T13:56:39.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Dart SDK",
"vendor": "Google LLC",
"versions": [
{
"lessThan": "2.16.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-02-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-18T13:35:11.000Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dart-review.googlesource.com/c/sdk/+/229947"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Auth bypass in Dark SDK",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@google.com",
"DATE_PUBLIC": "2022-02-03T11:00:00.000Z",
"ID": "CVE-2022-0451",
"STATE": "PUBLIC",
"TITLE": "Auth bypass in Dark SDK"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Dart SDK",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "2.16.0"
}
]
}
}
]
},
"vendor_name": "Google LLC"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dart-review.googlesource.com/c/sdk/+/229947",
"refsource": "MISC",
"url": "https://dart-review.googlesource.com/c/sdk/+/229947"
},
{
"name": "https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc",
"refsource": "MISC",
"url": "https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc"
}
]
},
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2022-0451",
"datePublished": "2022-02-18T13:35:11.903Z",
"dateReserved": "2022-02-01T00:00:00.000Z",
"dateUpdated": "2025-04-21T13:56:39.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-45031 (GCVE-0-2021-45031)
Vulnerability from cvelistv5 – Published: 2022-03-30 19:55 – Updated: 2026-05-18 12:06
VLAI
EPSS
VEX
Title
Weak Authentication in Login Function of USC+
Summary
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords.
Severity
7.7 (High)
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.usom.gov.tr/bildirim/tr-22-0269 | government-resourcebroken-link |
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
Date Public
2022-03-29 21:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:32:13.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.usom.gov.tr/bildirim/tr-22-0269"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "USC+",
"vendor": "Mepsan",
"versions": [
{
"lessThan": "3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "K\u00fcr\u015fat \u00c7ET\u0130N"
}
],
"datePublic": "2022-03-29T21:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA vulnerability in MEPSAN\u0027s USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords.\u003c/p\u003e"
}
],
"value": "A vulnerability in MEPSAN\u0027s USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:06:35.545Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource",
"broken-link"
],
"url": "https://www.usom.gov.tr/bildirim/tr-22-0269"
},
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0269"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUSC+ should be updated to the latest version provided by the vendor.\u003c/p\u003e"
}
],
"value": "USC+ should be updated to the latest version provided by the vendor."
}
],
"source": {
"advisory": "TR-22-0269",
"defect": [
"TR-22-0269"
],
"discovery": "EXTERNAL"
},
"title": "Weak Authentication in Login Function of USC+",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@usom.gov.tr",
"DATE_PUBLIC": "2022-03-30T21:00:00.000Z",
"ID": "CVE-2021-45031",
"STATE": "PUBLIC",
"TITLE": "Weak Authentication in Login Function of USC+"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "USC+",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "Mepsan"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "K\u00fcr\u015fat \u00c7ET\u0130N"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in MEPSAN\u0027s USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.usom.gov.tr/bildirim/tr-22-0269",
"refsource": "CONFIRM",
"url": "https://www.usom.gov.tr/bildirim/tr-22-0269"
}
]
},
"solution": [
{
"lang": "en",
"value": "USC+ should be updated to the latest version provided by the vendor."
}
],
"source": {
"advisory": "TR-22-0269",
"defect": [
"TR-22-0269"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2021-45031",
"datePublished": "2022-03-30T19:55:10.646Z",
"dateReserved": "2021-12-13T00:00:00.000Z",
"dateUpdated": "2026-05-18T12:06:35.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-43175 (GCVE-0-2021-43175)
Vulnerability from cvelistv5 – Published: 2021-12-07 17:25 – Updated: 2024-08-04 03:47
VLAI
EPSS
VEX
Summary
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Severity
No CVSS data available.
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.synopsys.com/blogs/software-security/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GOautodial | GOautodial API |
Affected:
< 3c3a979
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GOautodial API",
"vendor": "GOautodial",
"versions": [
{
"status": "affected",
"version": "\u003c 3c3a979"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305: Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-07T17:25:11.000Z",
"orgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b",
"shortName": "SNPS"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "disclosure@synopsys.com",
"ID": "CVE-2021-43175",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GOautodial API",
"version": {
"version_data": [
{
"version_value": "\u003c 3c3a979"
}
]
}
}
]
},
"vendor_name": "GOautodial"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305: Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities",
"refsource": "MISC",
"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b",
"assignerShortName": "SNPS",
"cveId": "CVE-2021-43175",
"datePublished": "2021-12-07T17:25:11.000Z",
"dateReserved": "2021-11-01T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:47:13.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28503 (GCVE-0-2021-28503)
Vulnerability from cvelistv5 – Published: 2022-02-04 22:29 – Updated: 2024-09-16 23:06
VLAI
EPSS
VEX
Title
In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
Summary
The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
Severity
7.4 (High)
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Arista EOS |
Affected:
EOS-4.23 , < EOS-4.23.10
(custom)
Affected: EOS-4.24 , < EOS-4.24.8 (custom) Affected: EOS-4.25 , < EOS-4.25.6 (custom) Affected: EOS-4.26 , < EOS-4.26.3 (custom) |
Date Public
2022-02-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:47:32.819Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Arista EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "EOS-4.23.10",
"status": "affected",
"version": "EOS-4.23",
"versionType": "custom"
},
{
"lessThan": "EOS-4.24.8",
"status": "affected",
"version": "EOS-4.24",
"versionType": "custom"
},
{
"lessThan": "EOS-4.25.6",
"status": "affected",
"version": "EOS-4.25",
"versionType": "custom"
},
{
"lessThan": "EOS-4.26.3",
"status": "affected",
"version": "EOS-4.26",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-02-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The impact of this vulnerability is that Arista\u0027s EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:29:27.000Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072"
}
],
"solutions": [
{
"lang": "en",
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience.\n\nThe vulnerability is fixed in the following EOS versions:\n 4.26.3 and later releases in the 4.26.x train\n 4.25.6 and later releases in the 4.25.x train\n 4.24.8 and later releases in the 4.24.x train\n 4.23.10 and later releases in the 4.24.x train"
}
],
"source": {
"advisory": "Security Advisory 0072",
"defect": [
"BUG606686"
],
"discovery": "INTERNAL"
},
"title": "In Arista\u0027s EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.",
"workarounds": [
{
"lang": "en",
"value": "Disallowing user certificate authentication via eAPI can be used to mitigate the vulnerability.\n\nswitch(config)#management security\nswitch(config-mgmt-security)#ssl profile profileEAPI\nswitch(config-mgmt-sec-ssl-profile-profileEAPI)#no trust certificate user.cert\nswitch(config-mgmt-sec-ssl-profile-profileEAPI)#exit"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@arista.com",
"DATE_PUBLIC": "2022-02-02T17:00:00.000Z",
"ID": "CVE-2021-28503",
"STATE": "PUBLIC",
"TITLE": "In Arista\u0027s EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Arista EOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "EOS-4.23",
"version_value": "EOS-4.23.10"
},
{
"version_affected": "\u003c",
"version_name": "EOS-4.24",
"version_value": "EOS-4.24.8"
},
{
"version_affected": "\u003c",
"version_name": "EOS-4.25",
"version_value": "EOS-4.25.6"
},
{
"version_affected": "\u003c",
"version_name": "EOS-4.26",
"version_value": "EOS-4.26.3"
}
]
}
}
]
},
"vendor_name": "Arista Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The impact of this vulnerability is that Arista\u0027s EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 Authentication Bypass by Primary Weakness"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072",
"refsource": "MISC",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072"
}
]
},
"solution": [
{
"lang": "en",
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience.\n\nThe vulnerability is fixed in the following EOS versions:\n 4.26.3 and later releases in the 4.26.x train\n 4.25.6 and later releases in the 4.25.x train\n 4.24.8 and later releases in the 4.24.x train\n 4.23.10 and later releases in the 4.24.x train"
}
],
"source": {
"advisory": "Security Advisory 0072",
"defect": [
"BUG606686"
],
"discovery": "INTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disallowing user certificate authentication via eAPI can be used to mitigate the vulnerability.\n\nswitch(config)#management security\nswitch(config-mgmt-security)#ssl profile profileEAPI\nswitch(config-mgmt-sec-ssl-profile-profileEAPI)#no trust certificate user.cert\nswitch(config-mgmt-sec-ssl-profile-profileEAPI)#exit"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2021-28503",
"datePublished": "2022-02-04T22:29:27.998Z",
"dateReserved": "2021-03-16T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:06:02.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26726 (GCVE-0-2021-26726)
Vulnerability from cvelistv5 – Published: 2022-02-16 15:15 – Updated: 2024-09-17 00:36
VLAI
EPSS
VEX
Title
Remote code execution in Valmet DNA before Collection 2021
Summary
A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.
Severity
8.8 (High)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.nozominetworks.com/labs/vulnerability… | x_refsource_CONFIRM |
| https://www.valmet.com/about-us/research-and-deve… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Valmet DNA | Valmet DNA |
Affected:
Collection 2012 , < Collection 2021
(custom)
|
Date Public
2022-02-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:33:41.017Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.valmet.com/about-us/research-and-development/vulnerabilityadvisories/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Valmet DNA",
"vendor": "Valmet DNA",
"versions": [
{
"lessThan": "Collection 2021",
"status": "affected",
"version": "Collection 2012",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This bug was found by Ivan Speziale of Nozomi Networks"
}
],
"datePublic": "2022-02-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Information Exposure Through an Error Message",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-272",
"description": "CWE-272 Least Privilege Violation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-16T15:15:12.000Z",
"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"shortName": "Nozomi"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.valmet.com/about-us/research-and-development/vulnerabilityadvisories/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Valmet DNA version Collection 2021"
}
],
"source": {
"advisory": "https://security.nozominetworks.com/NN-2021:2-01",
"defect": [
"NN_2021-0021"
],
"discovery": "EXTERNAL"
},
"title": "Remote code execution in Valmet DNA before Collection 2021",
"workarounds": [
{
"lang": "en",
"value": "Use Valmet DNA Firewall feature to limit access to TCP port 1517"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "prodsec@nozominetworks.com",
"DATE_PUBLIC": "2022-02-15T23:00:00.000Z",
"ID": "CVE-2021-26726",
"STATE": "PUBLIC",
"TITLE": "Remote code execution in Valmet DNA before Collection 2021"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Valmet DNA",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Collection 2012",
"version_value": "Collection 2021"
}
]
}
}
]
},
"vendor_name": "Valmet DNA"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This bug was found by Ivan Speziale of Nozomi Networks"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305 Authentication Bypass by Primary Weakness"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-209 Information Exposure Through an Error Message"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-272 Least Privilege Violation"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/",
"refsource": "CONFIRM",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/"
},
{
"name": "https://www.valmet.com/about-us/research-and-development/vulnerabilityadvisories/",
"refsource": "MISC",
"url": "https://www.valmet.com/about-us/research-and-development/vulnerabilityadvisories/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Upgrade to Valmet DNA version Collection 2021"
}
],
"source": {
"advisory": "https://security.nozominetworks.com/NN-2021:2-01",
"defect": [
"NN_2021-0021"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Use Valmet DNA Firewall feature to limit access to TCP port 1517"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"assignerShortName": "Nozomi",
"cveId": "CVE-2021-26726",
"datePublished": "2022-02-16T15:15:12.708Z",
"dateReserved": "2021-02-05T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:36:09.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.