CVE-2022-39031

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-863

Affected software

Vendor	Product	Versions
Smart eVision Information Technology Inc.	Smart eVision	2022.02.21

References

https://www.twcert.org.tw/tw/cp-132-6568-331c1-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-6568-331c1-1.htmlThird Party Advisory

Timeline

Published: Sep 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390328.8Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerabili CVE-2022-390339.8Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL CVE-2022-390346.5Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A CVE-2022-390356.1Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remo CVE-2022-390369.8The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can CVE-2022-390377.5Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability t CVE-2022-390388.8Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of CVE-2022-390399.8aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to se CVE-2022-39046.1The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauth CVE-2022-390407.5aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to byp CVE-2022-390419.8aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnera CVE-2022-390429.8aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authen