CVE-2022-45184

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a remote attacker with administrator privilege to create, delete, update, and display files outside of the configuration directory via a crafted HTTP request to particular endpoints in the web server. Patched Versions are 3.5.3 and 3.4.7.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.ironmansoftware.com/psu-2022-11-cve/Vendor Advisory
https://docs.powershelluniversal.com/changelogRelease Notes, Vendor Advisory
https://ironmansoftware.comVendor Advisory
https://blog.ironmansoftware.com/psu-2022-11-cve/Vendor Advisory
https://docs.powershelluniversal.com/changelogRelease Notes, Vendor Advisory
https://ironmansoftware.comVendor Advisory

Timeline

Published: Nov 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-451858.8An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can b CVE-2022-451868.1An issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of a database.CVE-2022-451887.8Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. This provides re CVE-2022-45194.8The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, CVE-2022-451905.3An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry in the legacy pairing CVE-2022-451916.5An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pair CVE-2022-451926.5An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a clea CVE-2022-451938.8CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.CVE-2022-451944.7CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.CVE-2022-451955.3SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere w CVE-2022-451967.5Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the sam CVE-2022-451977.5Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixm