Improper access control in Data Virtualization and Data Virtualization for AWS Marketplace - CVE-2022-30570
Published: July 20, 2022
Vulnerability identifier: #VU65552
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-30570
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the Column Based Security component. A remote user can bypass implemented security restrictions and gain read access to application information on the target system.
Affected software
Data Virtualization
Data Virtualization for AWS Marketplace
Data Virtualization for AWS Marketplace
How to mitigate CVE-2022-30570
Install updates from vendor's website.
Data Virtualization - update to 8.5.3
Data Virtualization for AWS Marketplace - update to 8.5.3
Data Virtualization for AWS Marketplace - update to 8.5.3