Vulnerabilities > CVE-2022-36110 - Unspecified vulnerability in Gravitl Netmaker

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

gravitl

NVD

Published: 2022-09-09

Updated: 2023-06-27

Summary

Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.

Vulnerable Configurations

Part	Description	Count
Application	Gravitl Gravitl Netmaker - Gravitl Netmaker 0.1 Gravitl Netmaker 0.2 Gravitl Netmaker 0.3 Gravitl Netmaker 0.5 Gravitl Netmaker 0.5.5 Gravitl Netmaker 0.5.10 Gravitl Netmaker 0.5.11 Gravitl Netmaker 0.7 Gravitl Netmaker 0.7.1 Gravitl Netmaker 0.7.3 Gravitl Netmaker 0.8.0 Gravitl Netmaker 0.8.1 Gravitl Netmaker 0.8.2 Gravitl Netmaker 0.8.3 Gravitl Netmaker 0.8.4 Gravitl Netmaker 0.8.5 Gravitl Netmaker 0.9.0 Gravitl Netmaker 0.9.1 Gravitl Netmaker 0.9.2 Gravitl Netmaker 0.9.3 Gravitl Netmaker 0.9.4 Gravitl Netmaker 0.10.0 Gravitl Netmaker 0.10.1 Gravitl Netmaker 0.11.0 Gravitl Netmaker 0.11.1 Gravitl Netmaker 0.12.0 Gravitl Netmaker 0.12.1 Gravitl Netmaker 0.12.2 Gravitl Netmaker 0.13.0 Gravitl Netmaker 0.13.1 Gravitl Netmaker 0.14.0 Gravitl Netmaker 0.14.1 Gravitl Netmaker 0.14.2 Gravitl Netmaker 0.14.3 Gravitl Netmaker 0.14.4 Gravitl Netmaker 0.14.5 Gravitl Netmaker 0.14.6 Gravitl Netmaker 0.15.0	39

Summary

Vulnerable Configurations

References