CVE-2022-40305

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-403065.9The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation opCVE-2022-403074.7An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-CVE-2022-403087.5If anonymous read enabled, it's possible to read the database file directly without logging in.CVE-2022-403094.3Users with write permissions to a repository can delete arbitrary directories.CVE-2022-40314.9The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parCVE-2022-403103.1Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers toCVE-2022-403114.8Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.CVE-2022-403126.5Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – DonCVE-2022-403137.1Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to loadCVE-2022-403149.8A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.CVE-2022-403159.8A limited SQL injection risk was identified in the "browse list of users" site administration page.CVE-2022-403164.3The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers ab