CVE-2022-1702

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an external site and uses that link in a redirect which leads to Open redirection vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17038.8Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attack CVE-2022-17049.8Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may l CVE-2022-17056.5Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request sm CVE-2022-17066.5A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. CVE-2022-17076.1The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the sit CVE-2022-17087.5A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecS CVE-2022-17094.3The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending),CVE-2022-17104.8The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allo CVE-2022-17117.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.CVE-2022-17124.3The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to m CVE-2022-17137.5SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This CVE-2022-17147.1Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented