WAPPLES through 6.0 has a hardcoded systemi account accessible via db/wp.no1 (as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file). A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
References
| Link | Resource |
|---|---|
| https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview | Patch Product Third Party Advisory Vendor Advisory |
| https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb | |
| https://www.pentasecurity.com/product/wapples/ | Product Vendor Advisory |
Configurations
History
17 Sep 2022, 01:50
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:pentasecurity:wapples:*:*:*:*:*:*:*:* | |
| CWE | CWE-798 | |
| References | (MISC) https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb - Exploit, Third Party Advisory | |
| References | (MISC) https://www.pentasecurity.com/product/wapples/ - Product, Vendor Advisory | |
| References | (MISC) https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview - Product, Third Party Advisory |
13 Sep 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-13 22:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-35413
Mitre link : CVE-2022-35413
CVE.ORG link : CVE-2022-35413
JSON object : View
Products Affected
pentasecurity
- wapples
CWE
CWE-798
Use of Hard-coded Credentials