Lucene search

MitreCVE-2022-47075

HistoryFeb 28, 2023 - 11:15 p.m.

CVE-2022-47075

2023-02-2823:15:11

mitre

web.nvd.nist.gov

cve-2022-47075

smart office web

information security

sensitive information

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.029

Percentile

91.0%

JSON

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

Affected configurations

Nvd

Node

smartofficepayrollsmartofficeRange≤20.28web

VendorProductVersionCPE
smartofficepayrollsmartoffice*cpe:2.3:a:smartofficepayroll:smartoffice:*:*:*:*:web:*:*:*

Vendor	Product	Version	CPE
smartofficepayroll	smartoffice	*	cpe:2.3:a:smartofficepayroll:smartoffice:::::web:::*

References

packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html

cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/

cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/

youtu.be/D42upepxzwM

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.029

Percentile

91.0%

JSON

Related for CVE-2022-47075