Lucene search

[email protected]CVE-2022-40742

HistoryOct 31, 2022 - 7:15 a.m.

CVE-2022-40742

2022-10-3107:15:10

CWE-22

[email protected]

web.nvd.nist.gov

cve-2022-40742

mail sqr expert

local file inclusion

vulnerability

php

asp

remote attack

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.0%

JSON

Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.

Affected configurations

NVD

Node

softnextmail_sqr_expertMatch2dut.220701

CPENameOperatorVersion
softnext:mail_sqr_expertsoftnext mail sqr experteq2dut.220701

CPE	Name	Operator	Version
softnext:mail_sqr_expert	softnext mail sqr expert	eq	2dut.220701

CNA Affected

[
  {
    "vendor": "SOFTNEXT TECHNOLOGIES CORP.",
    "product": "Mail SQR Expert",
    "versions": [
      {
        "version": "2dut.190301",
        "status": "affected"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-6644-d7aac-1.html

Social References

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.0%

JSON

Related for CVE-2022-40742

nvd1 prion1 cvelist1