CVE-2022-30622
Assigner: INCD
Published: 2022-07-13T00:00:00
State: PUBLISHED
affected: product: Chcnav - P5E GNSS 
vendor: Chcnav
versions: lessThan: 4.1*
status: affected
version: 4.2
versionType: custom
credits: value: MetaData
datePublic: 2022-07-13T00:00:00
descriptions: value: Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sys_username_passwd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within the JS code sent to the customer within the Login.js file is a strong user (which is not documented) and also the password, which allow for super-user access. Username: chcadmin, Password: chcpassword.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
problemTypes: descriptions: description: Information disclosure
type: text
source: defect: ILVN-2022-0032
discovery: EXTERNAL
title: Chcnav - P5E GNSS Information disclosure
x_generator: engine: Vulnogram 0.0.9