Vulnerability · Published Sep 13, 2022 · Assigned by mitre

CVE-2022-35413

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 18.0% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)18.0%top 2.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.pentasecurity.com/product/wapples/ x_refsource_MISC
https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview x_refsource_MISC
https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb x_refsource_MISC