What’s Vulnerable › Vulnerabilities

CVE-2022-45929

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-20 · updated 2026-06-17
• Weakness: CWE-284

Description

Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user.

Affected products

• Northern.Tech Mender: from 3.3.x before 3.3.2; from 3.5.x before 3.5.0; from 3.6.x before 3.6.0 — fixed in 3.3.2, 3.5.0, 3.6.0

How to fix

Upgrade to a fixed version: Northern.Tech Mender 3.3.2, 3.5.0, 3.6.0. Check the vendor advisory for mitigations.

References

• https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users
• https://northern.tech
• https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users
• https://northern.tech

Get alerted when CVE-2022-45929 or the next vulnerability affects your stack