CVE-2022-30290: High severity citeum opencti vulnerability
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30290?
The severity of CVE-2022-30290 is classified as critical due to its potential to allow unauthorized changes to user email addresses and API keys.
How do I fix CVE-2022-30290?
To fix CVE-2022-30290, you should upgrade OpenCTI to a version later than 5.2.4 where the vulnerability has been resolved.
What type of vulnerability is CVE-2022-30290?
CVE-2022-30290 is categorized as a broken access control vulnerability affecting the profile endpoint.
Who is affected by CVE-2022-30290?
Users of OpenCTI versions up to and including 5.2.4 are affected by CVE-2022-30290.
What can an attacker do with CVE-2022-30290?
An attacker can exploit CVE-2022-30290 to modify their own registered email address and API key without authorization.