Vulnerability Details : CVE-2022-37700
Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig.
Vulnerability category: Directory traversal
Products affected by CVE-2022-37700
- cpe:2.3:a:easycorp:zentao:15.0:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-37700
0.21%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 59 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-37700
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2022-37700
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-37700
-
https://medium.com/@sc0p3hacker/cve-2022-37700-directory-transversal-in-zentao-easy-soft-alm-2573c1f0fc21
CVE-2022–37700 Directory Transversal in ZenTao Easy soft ALM v16.5 | by Sc0p3 Hack3r | Sep, 2022 | MediumExploit;Third Party Advisory
-
https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig
Exploit;Third Party Advisory
-
http://zentao.com
zentao, professional graphic art and design with artist D. L. KeurProduct
Jump to