CVE-2022-2192

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

VendorProductVersions
HYPRHYPR Server>= next of 6.10, < unspecified; >= unspecified, <= 6.15.1

References

Timeline

Published
Jul 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-219208.8Windows Kerberos Elevation of Privilege VulnerabilityCVE-2022-219214.4Windows Defender Credential Guard Security Feature Bypass VulnerabilityCVE-2022-219228.8Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2022-219245.3Workstation Service Remote Protocol Security Feature Bypass VulnerabilityCVE-2022-219255.3Windows BackupKey Remote Protocol Security Feature Bypass VulnerabilityCVE-2022-219267.8HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-219277.8HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-219286.4Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityCVE-2022-219292.5Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2022-21938.8Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 autCVE-2022-219304.2Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2022-219314.2Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2022-2192: High severity, CVSS 8.8 | Vulnix