CVE-2022-25804

Name of the Vulnerable Software and Affected Versions IGEL Universal Management Suite version 6.07.100

Description An issue was discovered in the IGEL Universal Management Suite (UMS) that allows an unprivileged local attacker to read encrypted database user and password values for the UMS superuser due to insecure permissions for the serverconfig registry key under JavaSoftPrefsdeigelrmconfig in HKEY LOCAL MACHINESOFTWARE.

Recommendations For IGEL Universal Management Suite version 6.07.100, consider restricting access to the serverconfig registry key to prevent unauthorized reading of the encrypted dbuser and dbpassword values. As a temporary workaround, review and adjust the permissions of the serverconfig registry key to ensure that only authorized users have access to it.