Northern.tech vulnerabilities
We track 3 vulnerabilities in Northern.tech products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 20, 2024.
Latest Northern.tech vulnerabilities
- 8.8 High severity
mender: Improper Access Control
Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user.
- 7.5 High severity
Cfengine: Improper Neutralization of Special Elements used in an SQL Command
Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub.
- 9.8 Critical severity
Mender: Server-Side Request Forgery
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints.