CVE-2022-40291

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-402925.3The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each accouCVE-2022-402939.8The application was vulnerable to a session fixation that could be used hijack accounts.CVE-2022-402948.8The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within expoCVE-2022-402954.9The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which coCVE-2022-402969.8The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, CVE-2022-402977.8UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, CVE-2022-402988.8Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found CVE-2022-402997.8In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other usCVE-2022-40308.1The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which cCVE-2022-403009.8Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 befCVE-2022-403026.5An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length CVE-2022-403037.5An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled,
CVE-2022-40291: High severity, CVSS 8.8 | Vulnix