CVE-2022-24387

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
SmarterToolsSmarterTrack>= 100.0.8019.x, < Build 8075
smartertoolssmartertrack>= 100.0.8019.x, < Build_8075

References

Timeline

Published
Mar 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-243888.8Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network andCVE-2022-243898.8Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis NetwoCVE-2022-24397.2The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted iCVE-2022-243908.8Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into FidelisCVE-2022-243918.8Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level acCVE-2022-243928.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feedCVE-2022-243938.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “checCVE-2022-243948.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “updaCVE-2022-243956.1SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, reCVE-2022-243967.8The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be aCVE-2022-243976.1SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectCVE-2022-243986.5Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access
CVE-2022-24387: High severity, CVSS 7.2 | Vulnix