CVE-2022-39055

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

RAVA certificate validation system has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform SSRF attack to discover internal network topology base on query response.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Changing Information Technology Inc.	RAVA certificate validation system	3

References

https://www.twcert.org.tw/tw/cp-132-6616-9092f-1.htmlThird Party Advisory, VDB Entry
https://www.twcert.org.tw/tw/cp-132-6616-9092f-1.htmlThird Party Advisory, VDB Entry

Timeline

Published: Oct 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390569.8RAVA certificate validation system has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL c CVE-2022-390577.2RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with admi CVE-2022-390587.5RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability t CVE-2022-390597.5ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote a CVE-2022-39064.8The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2022-390609.8ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit CVE-2022-390616.5ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. A CVE-2022-390627.8A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for p CVE-2022-390637.5When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Respons CVE-2022-390648.1An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same CVE-2022-390656.5A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled wi CVE-2022-390668.8There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an