---
cve: "CVE-2022-1775"
severity: "HIGH"
cvss: 8.4
epss: "2.2%"
vendor: "polonel"
kev: false
exploited: false
published: "2022-05-20 23:15:44"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T19:51:52+01:00"
---

# CVE-2022-1775

> 8.4 HIGH · 🧪 PoC

## Beschreibung

Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.

## CNA-Record (Kanon, cvelistV5)

- CNA: **@huntrdev**
- State: PUBLISHED
- Stand: 2024-08-03 00:16:59
- CNA-CVSS: **8.4** (`CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H`)

## CVSS-Vektor

```
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-521** — Weak Password Requirements
  The product does not require that users should have strong passwords.

## Angriffsmuster (CAPEC)

- [CAPEC-16 — Dictionary-based Password Attack](https://capec.mitre.org/data/definitions/16.html) _(Severity: High)_
- [CAPEC-49 — Password Brute Forcing](https://capec.mitre.org/data/definitions/49.html) _(Severity: High)_
- [CAPEC-55 — Rainbow Table Password Cracking](https://capec.mitre.org/data/definitions/55.html) _(Severity: Medium)_
- [CAPEC-112 — Brute Force](https://capec.mitre.org/data/definitions/112.html) _(Severity: High)_
- [CAPEC-509 — Kerberoasting](https://capec.mitre.org/data/definitions/509.html) _(Severity: High)_
- [CAPEC-555 — Remote Services with Stolen Credentials](https://capec.mitre.org/data/definitions/555.html) _(Severity: Very High)_
- [CAPEC-561 — Windows Admin Shares with Stolen Credentials](https://capec.mitre.org/data/definitions/561.html)
- [CAPEC-565 — Password Spraying](https://capec.mitre.org/data/definitions/565.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1110.001 — Brute Force:Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
- [T1110.002 — Brute Force:Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
- [T1110 — Brute Force](https://attack.mitre.org/techniques/T1110/)
- [T1558.003 — Steal or Forge Kerberos Tickets:Kerberoasting](https://attack.mitre.org/techniques/T1558/003/)
- [T1021 — Remote Services](https://attack.mitre.org/techniques/T1021/)
- [T1114.002 — Email Collection:Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
- [T1133 — External Remote Services](https://attack.mitre.org/techniques/T1133/)
- [T1021.002 — Remote Services:SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002/)
- [T1110.003 — Brute Force:Password Spraying](https://attack.mitre.org/techniques/T1110/003/)

## Patch verfügbar (OSV)

- 7099d084920b6a616bc03077aa149b690620b4d6
- 13dd6c61fc85fa773b4065f075fceda563129c53

## Referenzen

- <https://huntr.dev/bounties/0966043c-602f-463e-a6e5-9a1745f4fbfa>
- <https://github.com/polonel/trudesk/commit/13dd6c61fc85fa773b4065f075fceda563129c53>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2022-1775/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_