CVE-2022-28861 - Vulnerability Details - OpenCVE

The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Axis	M1125
Citilog	Citilog

Configuration 1 [-]

AND

cpe:2.3:a:citilog:citilog:8.0:*:*:*:*:*:*:*

cpe:2.3:h:axis:m1125:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/ErwanBroquaire/citilog-8.0-vulnerability
https://www.citilog.com
https://www.citilog.com/wp-content/uploads/2023/07/CitilogSAS_information_note_2021-10-18-English.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-07-21T00:00:00

Updated: 2024-08-03T06:03:53.152Z

Reserved: 2022-04-08T00:00:00

Link: CVE-2022-28861

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-21T16:15:08.987

Modified: 2024-11-21T06:58:04.857

Link: CVE-2022-28861

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:citilog:citilog:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "BE7DFA39-D8F1-4C2A-9869-21CD7C2F5063", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:axis:m1125:-:*:*:*:*:*:*:*", "matchCriteriaId": "BE1E12B8-CCA3-4AE7-A9B7-FDFCABD2281E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server."}, {"lang": "es", "value": "El servidor en Citilog versi\u00f3n 8.0, permite a un atacante (en una posici\u00f3n de tipo man in the middle entre el servidor y su c\u00e1mara inteligente Axis M1125) visualizar las credenciales FTP en un tr\u00e1fico HTTP de texto sin cifrar. \u00c9stas pueden usarse para acceder al servidor por FTP"}], "id": "CVE-2022-28861", "lastModified": "2024-11-21T06:58:04.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-21T16:15:08.987", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/ErwanBroquaire/citilog-8.0-vulnerability"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.citilog.com"}, {"source": "cve@mitre.org", "url": "https://www.citilog.com/wp-content/uploads/2023/07/CitilogSAS_information_note_2021-10-18-English.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/ErwanBroquaire/citilog-8.0-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.citilog.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.citilog.com/wp-content/uploads/2023/07/CitilogSAS_information_note_2021-10-18-English.pdf"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}