CVE-2022-39033: critical vulnerability in Smart eVision
Smart eVision - Path Traversal -1
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.8%
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Smart eVision Information Technology Inc. · Smart eVisionRelated CVEs — Smart eVision
In the same product, most dangerous first.
CVE-2022-39034MEDIUMSmart eVision - Path Traversal -2EPSS 1.5%CVE-2022-39030HIGHSmart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2EPSS 0.9%CVE-2022-39032HIGHSmart eVision - Improper Privilege ManagementEPSS 0.9%CVE-2022-39029MEDIUMSmart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1EPSS 0.8%CVE-2022-39031MEDIUMSmart eVision - Exposure of Sensitive Information to an Unauthorized Actor -3EPSS 0.7%CVE-2022-39035MEDIUMSmart eVision - Stored XSSEPSS 0.6%