CVE-2022-36110

Summary

Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.

Affected Software

Weaknesses

• CWE-1220: CWE-1220: Insufficient Granularity of Access Control
• CWE-285: CWE-285: Improper Authorization

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg
• https://github.com/gravitl/netmaker/releases/tag/v0.15.1

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg
• https://github.com/gravitl/netmaker/releases/tag/v0.15.1

• ←Previous
• Next→