An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API requests.
References
| Link | Resource |
|---|---|
| https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636 | Exploit Third Party Advisory |
| https://labs.withsecure.com/advisories/insecure-authorization-scheme-for-api-requests-in-dbd--mobile-co | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-862 |
24 Mar 2023, 19:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-863 | |
| References | (MISC) https://labs.withsecure.com/advisories/insecure-authorization-scheme-for-api-requests-in-dbd--mobile-co - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CPE | cpe:2.3:a:megafeis:bofei_dbd\+:1.4.3:*:*:*:*:iphone_os:*:* cpe:2.3:a:megafeis:bofei_dbd\+:1.4.4:*:*:*:*:android:*:* |
|
| First Time |
Megafeis bofei Dbd\+
Megafeis |
21 Mar 2023, 20:07
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-21 18:15
Updated : 2023-12-10 15:01
NVD link : CVE-2022-45636
Mitre link : CVE-2022-45636
CVE.ORG link : CVE-2022-45636
JSON object : View
Products Affected
megafeis
- bofei_dbd\+
CWE
CWE-862
Missing Authorization