Vulnerability · Published Aug 16, 2022 · Assigned by Bitdefender
CVE-2022-1400Hardcoded encryption key IV in Exago WebReportsApi.dll
High 7.1
In plain English
A high-severity security flaw in CMDB from Device42. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.8%top 42.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
Affected products (as reported)
Weakness: CWE-321 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L