Lucene search

TwcertCVE-2022-38116

HistoryAug 30, 2022 - 5:15 a.m.

CVE-2022-38116

2022-08-3005:15:07

CWE-798

twcert

web.nvd.nist.gov

cve-2022-38116

le-yan personnel

salary management system

hard-coded credentials

remote access

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service.

Affected configurations

Nvd

Node

leyansalary_management_systemRange<2022-06-06

VendorProductVersionCPE
leyansalary_management_system*cpe:2.3:a:leyan:salary_management_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
leyan	salary_management_system	*	cpe:2.3:a:leyan:salary_management_system::::::::

CNA Affected

[
  {
    "product": "Personnel and Salary Management System",
    "vendor": "Le-yan Co., Ltd.",
    "versions": [
      {
        "lessThanOrEqual": "2022/6/6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-6460-2bb02-1.html

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

Related for CVE-2022-38116