What is CVE-2022-48195?

CVE-2022-48195 is a critical-severity vulnerability in Mellium Sasl, classified under Improper Authentication. CVSS score: 9.8/10. Published 2022-12-31.

How severe is CVE-2022-48195?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Mellium Sasl

CVE-2022-48195

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.

Vulnerability class: Broken Authentication

EPSS: 0.009 (56.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Mellium Sasl — versions 0.3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2022-48195?: CVE-2022-48195 is a critical-severity vulnerability in Mellium Sasl, classified under Improper Authentication. CVSS score: 9.8/10. Published 2022-12-31.
How severe is CVE-2022-48195?: Critical severity. CVSS v3 base score is 9.8 out of 10.