CVE-2022-2687230.01.2023, 16:15AMI Megarac Password reset interception via API EnginsightProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVectorNISTNIST8.3 HIGHNETWORKHIGHNONECVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HcertccCNA8.3 HIGHNETWORKHIGHNONECVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HCVEADP------CISA-ADPADP------Awaiting analysisThis vulnerability is currently awaiting analysis.Base ScoreCVSS 3.xEPSS ScorePercentile: 31%Common Weakness EnumerationCWE-640 - Weak Password Recovery Mechanism for Forgotten PasswordThe software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.Referenceshttps://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdfhttps://security.netapp.com/advisory/ntap-20230731-0008/https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdfhttps://security.netapp.com/advisory/ntap-20230731-0008/https://www.kb.cert.org/vuls/id/730007