Main Vulnerability Database Vulnerabilities #VU64942

Improper Certificate Validation in undici - CVE-2022-32210

Published: July 6, 2022

Vulnerability identifier: #VU64942

CSH Severity: Low

CVSS v4: 4.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N]

CVE-ID: CVE-2022-32210

CWE-ID: CWE-295

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user on the local network to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote authenticated user on the local network can send a specially crafted request to obtain sensitive information of all the requests and responses data to the proxy, and use this information to launch further attacks against the affected system.

Affected software

undici
App Connect Enterprise Certified Container

How to mitigate CVE-2022-32210

Install updates from vendor's website.

undici - update to 5.5.1
App Connect Enterprise Certified Container - addressed in versions 1.1.8, 4.1.0

External References

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterprise-certified-container-designerauthoring-operands-may-be-vulnerable-to-loss-of-confidentiality-due-to-cve-2022-32210/

Related Security Bulletins