CVE-2022-42733

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-73CWE-610

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-427347.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiCVE-2022-427358.8Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level adminCVE-2022-42749.8A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-propeCVE-2022-427435.3deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the applicatiCVE-2022-427449.8CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the apCVE-2022-427457.5CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulCVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is CVE-2022-427486.1CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. TCVE-2022-427496.1CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is poCVE-2022-42759.8A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionalityCVE-2022-427508.8CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does no
CVE-2022-42733: High severity, CVSS 7.5 | Vulnix