CVE-2022-23769

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Secuever Co.,Ltd	reverseWall-MDS	>= unspecified, <= 3.8 A007

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66962Third Party Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66962Third Party Advisory

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-23774.3The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user CVE-2022-237709.8This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructo CVE-2022-237718.8This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited CVE-2022-237727.5Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.CVE-2022-237737.5cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to CVE-2022-237745.3Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.CVE-2022-237759.8TrueStack Direct Connect 1.4.7 has Incorrect Access Control.CVE-2022-237795.3Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by CVE-2022-23786.1The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, lead CVE-2022-23797.5The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve info CVE-2022-237906.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Custo CVE-2022-237916.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Custo