Mender vulnerabilities

2 known vulnerabilities in Mender from Northern.tech. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  mender: Improper Access Control

  CVE-2022-45929Jun 20, 2024Northern.tech

  Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user.

• 9.8 Critical severity

  Mender: Server-Side Request Forgery

  CVE-2022-29556Apr 28, 2022Northern.techEPSS 1.03%

  The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints.