CVE-2022-25804: Medium severity igel universal management suite vulnerability
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEYLOCALMACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25804?
CVE-2022-25804 is classified as a high-severity vulnerability due to the potential exposure of sensitive credentials.
How do I fix CVE-2022-25804?
To fix CVE-2022-25804, you should update the IGEL Universal Management Suite to a patched version that addresses the insecure permissions.
What are the consequences of exploiting CVE-2022-25804?
Exploiting CVE-2022-25804 allows an unprivileged local attacker to read sensitive database credentials, potentially compromising the system.
Which versions of IGEL Universal Management Suite are affected by CVE-2022-25804?
CVE-2022-25804 affects IGEL Universal Management Suite version 6.07.100.
Who is affected by CVE-2022-25804?
Organizations using IGEL Universal Management Suite 6.07.100 are vulnerable to CVE-2022-25804.