CVE-2022-36110

{"containers": {"cna": {"affected": [{"product": "netmaker", "vendor": "gravitl", "versions": [{"status": "affected", "version": "< 0.15.1"}]}], "descriptions": [{"lang": "en", "value": "Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-285", "description": "CWE-285: Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-09T19:15:12.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1"}], "source": {"advisory": "GHSA-ggf6-638m-vqmg", "discovery": "UNKNOWN"}, "title": "Netmaker vulnerable to Insufficient Granularity of Access Control", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-36110", "STATE": "PUBLIC", "TITLE": "Netmaker vulnerable to Insufficient Granularity of Access Control"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "netmaker", "version": {"version_data": [{"version_value": "< 0.15.1"}]}}]}, "vendor_name": "gravitl"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-1220: Insufficient Granularity of Access Control"}]}, {"description": [{"lang": "eng", "value": "CWE-285: Improper Authorization"}]}]}, "references": {"reference_data": [{"name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg", "refsource": "CONFIRM", "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg"}, {"name": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1", "refsource": "MISC", "url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1"}]}, "source": {"advisory": "GHSA-ggf6-638m-vqmg", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:52:00.453Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T15:49:24.565249Z", "id": "CVE-2022-36110", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T17:12:19.594Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-36110", "datePublished": "2022-09-09T19:15:12.000Z", "dateReserved": "2022-07-15T00:00:00.000Z", "dateUpdated": "2025-04-23T17:12:19.594Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:52:00.453Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-36110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-23T15:49:24.565249Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T15:49:27.184Z"}}], "cna": {"title": "Netmaker vulnerable to Insufficient Granularity of Access Control", "source": {"advisory": "GHSA-ggf6-638m-vqmg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gravitl", "product": "netmaker", "versions": [{"status": "affected", "version": "< 0.15.1"}]}], "references": [{"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-09-09T19:15:12.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, "source": {"advisory": "GHSA-ggf6-638m-vqmg", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< 0.15.1"}]}, "product_name": "netmaker"}]}, "vendor_name": "gravitl"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg", "name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg", "refsource": "CONFIRM"}, {"url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1", "name": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-1220: Insufficient Granularity of Access Control"}]}, {"description": [{"lang": "eng", "value": "CWE-285: Improper Authorization"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-36110", "STATE": "PUBLIC", "TITLE": "Netmaker vulnerable to Insufficient Granularity of Access Control", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-36110", "state": "PUBLISHED", "dateUpdated": "2025-04-23T17:12:19.594Z", "dateReserved": "2022-07-15T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-09-09T19:15:12.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "netmaker", "vendor": "gravitl", "versions": [{"status": "affected", "version": "< 0.15.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*", "matchCriteriaId": "5812FD55-0BFE-406E-879F-F725A6C8E012", "versionEndExcluding": "0.15.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1."}, {"lang": "es", "value": "Netmaker hace redes con WireGuard. En versiones anteriores a 0.15.1, unas funciones de Autorizaci\u00f3n Inapropiada conllevan e que usuarios no privilegiados ejecutaran llamadas a la API privilegiadas. Si alguien a\u00f1ade usuarios a la plataforma Netmaker que no presentan privilegios de administrador, pueden usar sus auth tokens para ejecutar funciones de nivel de administrador por medio de la API. Este problema ha sido corregido en versi\u00f3n 0.15.1"}], "id": "CVE-2022-36110", "lastModified": "2026-06-17T04:52:56.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-36110", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T15:49:24.565249Z", "version": "2.0.3"}}]}, "published": "2022-09-09T20:15:11.263", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/gravitl/netmaker/releases/tag/v0.15.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-1220"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}