CVE-2022-21215

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

• CWE-918
• CWE-918

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02Third Party Advisory, US Government Resource
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02Third Party Advisory, US Government Resource

Published

Feb 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2121OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL point…6.5
• CVE-2022-21210An SQL injection vulnerability exists in the AssetActions.as…8.8
• CVE-2022-21211This affects all versions of package posix. When invoking th…7.5
• CVE-2022-21212Improper input validation for some Intel(R) PROSet/Wireless …6.5
• CVE-2022-21213This affects all versions of package mout. The deepFillIn fu…7.5
• CVE-2022-21214The affected product is vulnerable to a heap-based buffer ov…7.8
• CVE-2022-21216Insufficient granularity of access control in out-of-band ma…6.8
• CVE-2022-21217An out-of-bounds write vulnerability exists in the device Te…9.8
• CVE-2022-21218Uncaught exception in the Intel(R) Trace Analyzer and Collec…5.5
• CVE-2022-21219Out-of-bounds read vulnerability in CX-Programmer v9.76.1 an…7.8
• CVE-2022-2122DOS / potential heap overwrite in qtdemux using zlib decompr…7.8
• CVE-2022-21220Improper restriction of XML external entity for Intel(R) Qua…7.8