CVE-2022-39820: Medium severity nokia network functions manager for transport vulnerability
In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom199/OTNEDRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39820?
CVE-2022-39820 has a CVSS score indicating a high severity due to unprotected credential storage.
How do I fix CVE-2022-39820?
To fix CVE-2022-39820, secure the storage of credentials by applying access controls and encryption.
What software is affected by CVE-2022-39820?
CVE-2022-39820 affects Nokia Network Functions Manager for Transport version 19.9.
Can a remote user exploit CVE-2022-39820?
Yes, a remote user with OS access privileges can exploit CVE-2022-39820 due to unprotected credential storage.
What type of vulnerability is CVE-2022-39820?
CVE-2022-39820 is classified as an unprotected storage of credentials vulnerability.