{"cve":"CVE-2022-35413","epss":{"score":0.17979},"mitre":{"cpes":[],"created":"2022-09-13T22:00:24+00:00","description":"WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2022/35xxx/CVE-2022-35413.json","references":["https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview","https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb","https://www.pentasecurity.com/product/wapples/"],"title":null,"updated":"2024-08-03T09:36:44.148000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:pentasecurity:wapples:*:*:*:*:*:*:*:*"],"created":"2022-09-13T22:15:09.080000+00:00","description":"WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2022/CVE-2022-35413.json","references":["https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview","https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb","https://www.pentasecurity.com/product/wapples/"],"title":null,"updated":"2026-06-17T04:51:47.647000+00:00","vendors":["pentasecurity","pentasecurity$PRODUCT$wapples"],"weaknesses":["CWE-798"]},"opencve":{"changes":[],"cpes":{"data":["cpe:2.3:a:pentasecurity:wapples:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2022-09-13T22:00:24+00:00","provider":"mitre"},"description":{"data":"WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.17979},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview","https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb","https://www.pentasecurity.com/product/wapples/"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2024-11-21T07:11:07.760000+00:00","provider":"nvd"},"vendors":{"data":["pentasecurity","pentasecurity$PRODUCT$wapples"],"providers":["nvd"]},"weaknesses":{"data":["CWE-798"],"providers":["nvd"]}}}