# CVE-2022-29555 and CVE-2022-29556 - vulnerabilities in iot-manager and deviceconnect | Mender

**URL:** <https://hub.mender.io/t/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect-mender/4908>\
**Category:** Announcements\
**Created:** [April 27, 2022, 9:50pm UTC](https://hub.mender.io/t/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect-mender/4908 "2022-04-27T21:50:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![farshadt](https://avatars.discourse-cdn.com/v4/letter/f/c37758/32.png) [@farshadt](https://hub.mender.io/u/farshadt)\
**Post date:** [April 27, 2022, 9:50pm UTC](https://hub.mender.io/t/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect-mender/4908/1 "2022-04-27T21:50:09Z")

</div>

We recently discovered two vulnerabilities in Mender, and we have now fixed them.

The deviceconnect microservice in Mender before version 3.2.2 allows Cross-Origin WebSocket Hijacking. The vulnerability is present in the following versions of the product: 2.6.x, 2.7.x, 3.0.x, 3.1.x, 3.2.0, 3.2.1. The vulnerability was patched in Mender 3.2.2. In the official public CVE registry, the issue's ID is [CVE-2022-29555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29555).

* * *
This is a companion discussion topic for the original entry at [https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect](https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect)