High severity · published Aug 15, 2022
CVE-2022-38368
An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Gateway · Aviatrix
before 6.6.5712; 6.7.0 before 6.7.1376 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38368
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38368
Vendor Advisory
https://docs.aviatrix.com/HowTos/PSIRT_Advisories.html#aviatrix-controller-and-gateways-unauthorized-access
More from Gateway
9.8
CVE-2020-13417
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224
7.5
CVE-2020-13414
An issue was discovered in Aviatrix Controller before 5.4.1204