CVE-2022-3188
21.12.2022, 23:15
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users.Enginsight
| Vendor | Product | Version |
|---|---|---|
| dataprobe | iboot-pdu4-n20_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu4sa-n15_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu4a-n15_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu4sa-n20_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu4a-n20_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8sa-n15_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8a-n15_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8sa-2n15_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8a-2n15_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8sa-n20_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8a-n20_firmware | 𝑥 < 1.42.06162022 |
| dataprobe | iboot-pdu8a-2n20_firmware | 𝑥 < 1.42.06162022 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-306 - Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.