CVE-2022-45167

Vulnerability

The vulnerability exists in Archibus Web Central version 2022.03.01.107. A service exposed by the application does not properly enforce access controls, allowing a basic user to retrieve profile information of all connected users. [1][2]

Exploitation

An attacker must have a basic user account (authenticated) and can exploit the service over the network. No user interaction is required. The attacker can simply make a request to the vulnerable service to obtain the profile data of other users. [2]

Impact

Successful exploitation results in unauthorized access to profile information (e.g., names, contact details) of all connected users. This is a low confidentiality impact; integrity and availability are not affected. The CVSS score is 4.3. [2]

Mitigation

As of the disclosure date, no patches are available. The vendor was contacted multiple times and acknowledged the issue, but no fix has been released. Organizations should monitor for updates or consider restricting access to the vulnerable service via network controls. [2]