CVE-2022-23770

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-22

Affected software

Vendor	Product	Versions
WISA corp.	Smart Wing CMS	>= unspecified, < ver.19051

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963Third Party Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963Third Party Advisory

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237718.8This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited CVE-2022-237727.5Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.CVE-2022-237737.5cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to CVE-2022-237745.3Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.CVE-2022-237759.8TrueStack Direct Connect 1.4.7 has Incorrect Access Control.CVE-2022-237795.3Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by CVE-2022-23786.1The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, lead CVE-2022-23797.5The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve info CVE-2022-237906.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Custo CVE-2022-237916.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Custo CVE-2022-237937.5An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write file CVE-2022-237945.3An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. T