CVE-2022-22795
Last modified
CVE-2022-22795 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Signiant | Manager\+Agents | < 13.5 |
| Signiant | Manager\+Agents | 14.0 |
| Signiant | Manager\+Agents | 15.0 |
References
- https://www.gov.il/en/departments/faq/cve_advisoriesThird Party Advisory
- https://www.gov.il/en/departments/faq/cve_advisoriesThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-22795?
How severe is CVE-2022-22795?
How do I fix CVE-2022-22795?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2279NULL Pointer Dereference in GitHub repository bfabiszewski/l…5.5
- CVE-2022-22790SYNEL - eharmony Directory Traversal. Directory Traversal - …7.5
- CVE-2022-22791SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS…5.4
- CVE-2022-22792MobiSoft - MobiPlus User Take Over and Improper Handling of …7.5
- CVE-2022-22793Cybonet - PineApp Mail Relay Local File Inclusion. Attacker …7.5
- CVE-2022-22794Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. …9.8
- CVE-2022-22796Sysaid – Sysaid System Takeover - An attacker can bypass the…9.8
- CVE-2022-22797Sysaid – sysaid Open Redirect - An Attacker can change the r…6.1
- CVE-2022-22798Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Co…8.8
- CVE-2022-2280Cross-site Scripting (XSS) - Stored in GitHub repository mic…5.4
- CVE-2022-22804A CWE-79: Improper Neutralization of Input During Web Page G…5.4
- CVE-2022-22805A CWE-120: Buffer Copy without Checking Size of Input ('Clas…9.8
Are you affected by CVE-2022-22795?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST