Softing Secure Integration Server Cleartext Transmission of Sensitive Information
CVE-2022-2338

5.7MEDIUM

Key Information:

Vendor

Softing

Status
Secure Integration Server
Vendor
CVE Published:
17 August 2022

What is CVE-2022-2338?

Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server.

Affected Version(s)

Secure Integration Server V1.22

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04
x_refsource_CONFIRM
https://industrial.softing.com/fileadmin/psirt/downloads/...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro Ribeiro and Radek Domanski, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to Softing and CISA.
.