CVE-2022-23742

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-65CWE-59

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-237437.8Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weaCVE-2022-237442.3Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bCVE-2022-237457.5A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application craCVE-2022-237467.5The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured foCVE-2022-237479.8In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed CVE-2022-237487.8mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under CVE-2022-23755.4The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthentiCVE-2022-23765.3The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated aCVE-2022-237638.8Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers cCVE-2022-237649.8The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass CVE-2022-237658.8This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NASCVE-2022-237668.8An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary f
CVE-2022-23742: High severity, CVSS 7.8 | Vulnix