CVE-2022-28866
First published: Tue Oct 11 2022(Updated: )
Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or editing of) data and functionality in all endpoints under /#settings/* and /api/settings/*. By not verifying the permissions for access to resources, it allows a potential attacker to view pages, with sensitive data, that are not allowed, and modify system configurations also causing DoS, which should be accessed only by user with administration profile, bypassing all controls (without checking for user identity).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nokia Airframe Bmc Web Gui R18 Firmware | <4.13.00 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-28866?
CVE-2022-28866 is a vulnerability found in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00, which allows improper access control and does not properly validate requests for access to data and functionality in specific endpoints.
What is the severity of CVE-2022-28866?
CVE-2022-28866 has a severity rating of 8.8 (high).
How does CVE-2022-28866 affect Nokia AirFrame BMC Web GUI?
CVE-2022-28866 affects Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00 by allowing improper access control and lack of validation for access requests in certain endpoints.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-28866?
CVE-2022-28866 is associated with CWE-862 (Missing Authorization).
Are there any references available for CVE-2022-28866?
Yes, you can find more information about CVE-2022-28866 at the following references: [link1], [link2].
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- vendor/nokia
- canonical/nokia airframe bmc web gui r18 firmware