CVE-2022-36110
High
Description
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.
SeverityHigh
CVSS8.8
Exploit probability—
ProductNetmaker
PublishedSep 9, 2022
First seenSep 9, 2022
Weakness typeCWE-1220CWE-1220CWE-285CWE-285
How to fix
Update
- netmaker netmaker0.15.1 or later
- github.com/gravitl/netmaker0.15.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netmaker netmaker | v < 0.15.1 | 0.15.1 |
| github.com/gravitl/netmakerGo | v < 0.15.1 | 0.15.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.