CVE-2022-2338
Softing Secure Integration Server Cleartext Transmission of Sensitive Information
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server.
Softing Secure Integration Server versión V1.22, es vulnerable a una omisión de la autenticación por medio de un ataque de tipo "machine-in-the-middle". Por defecto, la interfaz de administración es accesible por medio del protocolo HTTP en texto plano, lo que facilita el ataque. La petición HTTP puede contener la cookie de sesión en la petición, que puede ser capturada para su uso en la autenticación al servidor.
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Softing Secure Integration Server. User interaction is required to exploit this vulnerability.
The specific flaw exists within the handling of administrator credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to bypass authentication on the system.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-07-06 CVE Reserved
- 2022-08-17 CVE Published
- 2024-07-16 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-319: Cleartext Transmission of Sensitive Information
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 | Mitigation |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html | 2022-08-19 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Softing Search vendor "Softing" | Edgeaggregator Search vendor "Softing" for product "Edgeaggregator" | 3.1 Search vendor "Softing" for product "Edgeaggregator" and version "3.1" | - |
Affected
| ||||||
| Softing Search vendor "Softing" | Edgeconnector Search vendor "Softing" for product "Edgeconnector" | 3.1 Search vendor "Softing" for product "Edgeconnector" and version "3.1" | - |
Affected
| ||||||
| Softing Search vendor "Softing" | Opc Search vendor "Softing" for product "Opc" | 5.2 Search vendor "Softing" for product "Opc" and version "5.2" | - |
Affected
| ||||||
| Softing Search vendor "Softing" | Opc Ua C\+\+ Software Development Kit Search vendor "Softing" for product "Opc Ua C\+\+ Software Development Kit" | 6 Search vendor "Softing" for product "Opc Ua C\+\+ Software Development Kit" and version "6" | - |
Affected
| ||||||
| Softing Search vendor "Softing" | Secure Integration Server Search vendor "Softing" for product "Secure Integration Server" | 1.22 Search vendor "Softing" for product "Secure Integration Server" and version "1.22" | - |
Affected
| ||||||
| Softing Search vendor "Softing" | Uagates Search vendor "Softing" for product "Uagates" | 1.74 Search vendor "Softing" for product "Uagates" and version "1.74" | - |
Affected
| ||||||