CVE-2022-37772
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
The vulnerability in Maarch RM 2.8.3 is due to improper restriction of excessive authentication attempts, manifested by overly verbose responses from the application. An unauthenticated remote attacker could exploit this flaw to perform brute-force attacks on user accounts.
Risk Assessment
The risk involves potential compromise of user accounts through brute-force attacks, leading to unauthorized access to sensitive documents and data within the document management system.
Recommendation
Update Maarch RM to the latest version and implement mechanisms to limit login attempts, such as account lockout after a certain number of failed attempts or delays between attempts.
Other vulnerabilities in Maarch RM
See all- CVE-2022-37774Medium
A broken access control vulnerability was found in Maarch RM 2.8.3. When previewing documents (PDF, email) from an archive, the application generates a URL containing an MD5 hash of the file, which is accessible without authentication.
- CVE-2022-37773Medium
An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
Original NVD description (English source)
Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts.