Insecure Permissions in IGEL Universal Management Suite
CVE-2022-25804

5.5MEDIUM

Key Information:

Vendor

Igel

Status
Universal Management Suite
Vendor
CVE Published:
9 June 2022

What is CVE-2022-25804?

The IGEL Universal Management Suite (UMS) version 6.07.100 contains a security flaw due to insecure permissions on the serverconfig registry key. This vulnerability allows an unprivileged local attacker to gain unauthorized access to sensitive information, specifically the encrypted dbuser and dbpassword values associated with the UMS superuser account. Proper security configurations are essential to prevent potential exploitation of this weakness, which may lead to unauthorized access and compromise of the UMS environment.

References

https://www.igel.com/igel-solution-family/universal-manag...
x_refsource_MISC
https://github.com/atredispartners/advisories/blob/master...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.