CVE-2022-38168

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Nov 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-38176.5A vulnerability has been found in Axiomatic Bento4 and classified as problematic. Affected by this vulnerability is an unknown functionalityCVE-2022-381704.7In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag whiCVE-2022-381717.8Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). ProcessinCVE-2022-381726.1ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboarCVE-2022-381767.8An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the ClientCVE-2022-381777.5By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is posCVE-2022-381787.5By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is posCVE-2022-381796.1JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attackCVE-2022-38185.3An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, aCVE-2022-381806.5In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some casesCVE-2022-381818.8The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects BCVE-2022-381836.5In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could ass
CVE-2022-38168: Critical severity, CVSS 9.1 | Vulnix