CVE-2022-23767

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22CWE-89CWE-288

Affected software

VendorProductVersions
HANSSAK Co.,LtdSecureGate3.5
HANSSAK Co.,LtdWebLink>= 3.5.2, <= 3.5.5

References

Timeline

Published
Sep 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-237689.8This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to iCVE-2022-237699.8Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulCVE-2022-23774.3The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated userCVE-2022-237709.8This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructoCVE-2022-237718.8This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploitedCVE-2022-237727.5Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.CVE-2022-237737.5cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to CVE-2022-237745.3Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.CVE-2022-237759.8TrueStack Direct Connect 1.4.7 has Incorrect Access Control.CVE-2022-237795.3Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered byCVE-2022-23786.1The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leadCVE-2022-23797.5The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve info