Servisnet Tessa information disclosure | CVE-2022-22833
NAME
Servisnet Tessa information disclosure
- Platforms Affected:
Servisnet Tessa - Risk Level:
9.8 - Exploitability:
Functional - Consequences:
Obtain Information
DESCRIPTION
Servisnet Tessa could allow a remote attacker to obtain sensitive information, caused by the exposure of the default value for the Authorization HTTP header in the app.js script. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain Message Queuing Telemetry Transport protocol connection information, and use this information to launch further attacks against the affected system.
CVSS 3.0 Information
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Access Vector: Network
- Access Complexity: Low
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Remediation Level: Unavailable
MITIGATION
No remedy available as of February 4, 2022.
- Reference Link:
https://packetstormsecurity.com/files/165867 - Reference Link:
https://www.exploit-db.com/exploits/50713
If you like the site, please consider joining the telegram channel and supporting us on Patreon using the button below.
