CVE-2022-1805
Last modified
CVE-2022-1805 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Teradici | Tera2 Pcoip Zero Client Firmware | < 22.01.5 |
| Teradici | Tera2 Pcoip Zero Client Firmware | 22.04 |
References
- https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794Patch, Vendor Advisory
- https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1805?
How severe is CVE-2022-1805?
How do I fix CVE-2022-1805?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1799Incorrect signature trust exists within Google Play services…9.8
- CVE-2022-1800The Export any WordPress data to XML/CSV WordPress plugin be…7.2
- CVE-2022-1801The Very Simple Contact Form WordPress plugin before 11.6 ex…7.5
- CVE-2022-1802If an attacker was able to corrupt the methods of an Array o…8.8
- CVE-2022-1803Improper Restriction of Rendered UI Layers or Frames in GitH…6.9
- CVE-2022-1804accountsservice no longer drops permissions when writting .p…5.5
- CVE-2022-1806Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
- CVE-2022-1807Multiple SQLi vulnerabilities in Webadmin allow for privileg…7.2
- CVE-2022-1808Execution with Unnecessary Privileges in GitHub repository p…8.8
- CVE-2022-1809Access of Uninitialized Pointer in GitHub repository radareo…7.8
- CVE-2022-1810Authorization Bypass Through User-Controlled Key in GitHub r…4.3
- CVE-2022-1811Unrestricted Upload of File with Dangerous Type in GitHub re…5.4
Are you affected by CVE-2022-1805?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST