CVE-2022-34908
HIGHaremis_4_nomads < 1.5.1 - Unauthenticated Data Exposure via Missing Token Validation
Title source: llmDescription
An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization to retrieve application data.
References (3)
Core 3
Core References
Various Sources
https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34908
Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2022-34908
Not Applicable
https://www.aremis.com/en_GB/welcome
Scores
CVSS v3
8.2
EPSS
0.0064
EPSS Percentile
45.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-287
CWE-306
Status
published
Products (1)
aremis/aremis_4_nomads
< 1.5.1
Published
Feb 27, 2023
Tracked Since
Feb 18, 2026