CVE-2022-23342
Medium
Description
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the /mobilebroker/ServiceToBroker.svc/Json/Connect endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems.
SeverityMedium
CVSS5.3
Exploit probability—
ProductHyland Onbase
PublishedJun 21, 2022
First seenJun 21, 2022
How to fix
Update
- hyland onbase20.3.58.1000 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hyland onbase | v < 20.3.58.1000, 21.1.1.1000 ≤ v ≤ 21.1.15.1000 | 20.3.58.1000 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.