Cleartext Transmission Vulnerability in IGEL Universal Management Suite
CVE-2022-25805

6.5MEDIUM

Key Information:

Vendor

Igel

Status
Universal Management Suite
Vendor
CVE Published:
9 June 2022

What is CVE-2022-25805?

The IGEL Universal Management Suite (UMS) version 6.07.100 is susceptible to a vulnerability that results from the transmission of cleartext LDAP bind credentials via the cmd_mgt_load_mgt_tree command. This allows an attacker, who has access to intercept or inspect network traffic between an authenticated UMS client and server, to potentially compromise sensitive credentials. This exploit could lead to unauthorized access and manipulation of network resources, highlighting the need for secure protocols in transmitting sensitive information.

References

https://www.igel.com/igel-solution-family/universal-manag...
x_refsource_MISC
https://github.com/atredispartners/advisories/blob/master...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.