Insufficient Granularity of Access Control in Netmaker - CVE-2022-36110

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128017

Insufficient Granularity of Access Control in Netmaker - CVE-2022-36110

Published: September 9, 2022 / Updated: April 27, 2026


Vulnerability identifier: #VU128017
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2022-36110
CWE-ID: CWE-1220
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Netmaker
Software vendor:
GRAVITL

Description

The vulnerability allows a remote user to perform admin-level API actions.

The vulnerability exists due to insufficient granularity of access control in the Netmaker API when handling authenticated API requests. A remote user can use a valid auth token to invoke privileged functions to perform admin-level API actions.


Remediation

Install security update from vendor's website.

External links