CVE-2022-24637observed exploitation

CVE-2022-24637

Published · Updated

Follow this CVE+ Monitor open-web-analytics/open-web-analytics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 99%
from disclosure to weapon165 days
Published on NVDMar 18
1st PoC+165d
metasploitMar 18
VulnCheck+1682d
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.