ByteOS Network

NVD Vulnerability Details :

CVE-2022-22551

Analyzed

Source-security_alert@emc.com

Published At-21 Jan, 2022 | 21:15

Updated At-27 Jan, 2022 | 15:00

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	8.3	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Primary	2.0	5.8	MEDIUM	AV:A/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.3

Base severity: HIGH

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Type: Primary

Version: 2.0

Base score: 5.8

Base severity: MEDIUM

Vector:

AV:A/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Dell Inc.

>>emc_appsync>>Versions before 4.4.0.0(exclusive)

cpe:2.3:a:dell:emc_appsync:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-384	Primary	nvd@nist.gov
CWE-598	Secondary	security_alert@emc.com

CWE ID: CWE-384

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-598

Type: Secondary

Source: security_alert@emc.com

References

Hyperlink	Source	Resource
https://www.dell.com/support/kbdoc/000195377	security_alert@emc.com	Patch Vendor Advisory

Hyperlink: https://www.dell.com/support/kbdoc/000195377

Source: security_alert@emc.com

Resource:

Patch

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History