CVE-2022-40319
CVE-2022-40319
In short
LISTSERV 17's web interface has a security flaw that allows attackers to modify other people's accounts by changing an email address in the web URL. This means someone could hijack your account without proper permission checks.
Technical detail
An IDOR vulnerability in LISTSERV 17's wa.exe endpoint fails to validate authorization when processing email address parameters in URLs, allowing attackers to modify arbitrary user accounts. The vulnerability requires network access to the web interface but no authentication, resulting in unauthorized account takeover and configuration changes.
Summary generated and translated by AI from the official description.
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/2301-exploits/listserv17-idor.txtunverifiedexploitdbwww.exploit-db.com/exploits/51149unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →