Paper/Archive/CVE-2022-38168

CVE-2022-38168

mitre — Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated att…

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD, ADP agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 70.2.702 × 2014.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refmedium.com/%40rob_nes/avaya-scopia-pathfinder-broken-access-control-ac792e995bae