CVE-2022-31289

 

Published at: - 14-06-2022 07:15

Last modified: - 15-06-2022 02:53

Total changes: - 1

Description

https://ossindex.sonatype.org/ Sonatype Nexus Repository Manager OSS 3.37.3-02 is affected by: Incorrect Access Control. The impact is: Authentication Bypass (remote). The component is: Admin Panel. The attack vector is: With the help of response manipulation Attacker can bypass the login panel and view the dashboard menus, No user interaction is required. ¶¶ 1. Go to https://nexus.e-goi.com 2. Click on the Sign In button. 3. Enter the password as admin:admin. 4. Intercept the request in Burp Suite. 5. Capture the Response of the Request. 6. Change the Status Code from 403 Forbidden to 200 OK. 7. You will see the dashboard which provides the admin access.

Common Vulnerability Scoring System (CVSS)

-

 

 

Reference

• https://medium.com/@pmmali/my-first-cve-2022-31289-4081c57e90fb
• https://www.acunetix.com/vulnerabilities/web/tag/authentication-bypass/

 

Keywords

NVD

 

CVE-2022-31289

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures