Vulnerabilities

TI-2022-01397 CVE-2022-1524 · GHSA-qqpc-gc88-ff86

3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319

LOW 34

LRM version 2.4 and lower does not implement TLS encryption.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00324 Published 2022-06-24 No fix listed CWE-319

TI-2022-01394 CVE-2022-1521 · GHSA-hgpf-hf44-725p

MEDIUM 50

LRM does not implement authentication or authorization by default.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01143 Published 2022-06-24 No fix listed CWE-284

TI-2022-01391 CVE-2022-1518 · GHSA-gf32-9r48-vxjm

MEDIUM 52

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01669 Published 2022-06-24 No fix listed CWE-22

TI-2022-01392 CVE-2022-1519 · GHSA-4pg3-x42q-599h

MEDIUM 52

LRM does not restrict the types of files that can be uploaded to the affected product.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01403 Published 2022-06-24 No fix listed CWE-434

TI-2022-01390 CVE-2022-1517 · GHSA-xwwx-p8gv-wf69

MEDIUM 52

LRM utilizes elevated privileges.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01822 Published 2022-06-24 No fix listed CWE-250