CVE-2022-29932

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.mdExploit, Third Party Advisory
https://www.primeur.com/managed-file-transferVendor Advisory
https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.mdExploit, Third Party Advisory
https://www.primeur.com/managed-file-transferVendor Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299338.8Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an CVE-2022-299347.8USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE CVE-2022-299357.5USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is no CVE-2022-299368.8USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upl CVE-2022-299378.8USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands CVE-2022-299388.8In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\pa CVE-2022-299395.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multip CVE-2022-299405.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to mu CVE-2022-299426.5Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perfor CVE-2022-299436.5Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve re CVE-2022-299445.3An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect CVE-2022-299457.5DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope