CVE-2022-38115
23.11.2022, 17:15
Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUTEnginsight
| Vendor | Product | Version |
|---|---|---|
| solarwinds | security_event_manager | 𝑥 < 2022.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-650 - Trusting HTTP Permission Methods on the Server SideThe server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.
- CWE-436 - Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References