Vulnerability in Okta Active Directory Agent
CVE-2022-1697
Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (15.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.000
Affected products
- Okta Active Directory Agent — versions 3.8.0, 3.9.0, 3.10.0
- Okta Active Directory Agent — versions 3.8.0, 3.9.0, 3.10.0, 3.11.0
Weakness classification (CWE)
References
- trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697 (Vendor Advisory)
- help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm (Vendor Advisory)
- support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-1697?
- CVE-2022-1697 is a low-severity vulnerability in Okta Active Directory Agent, classified under Unquoted Search Path or Element. CVSS score: 3.9/10. Published 2022-09-06.
- How severe is CVE-2022-1697?
- Low severity. CVSS v3 base score is 3.9 out of 10.