CVE-2022-24985
Last modified
CVE-2022-24985 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server.. EPSS estimates a 2.28% chance of exploitation in the next 30 days.
Description
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jqueryform | Jqueryform | < 2022-02-05 |
References
- https://JQueryForm.comVendor Advisory
- https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560Third Party Advisory
- https://www.nou-systems.com/cyber-securityThird Party Advisory
- https://JQueryForm.comVendor Advisory
- https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560Third Party Advisory
- https://www.nou-systems.com/cyber-securityThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-24985?
How severe is CVE-2022-24985?
How do I fix CVE-2022-24985?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2498An issue in pipeline subscriptions in GitLab EE affecting al…7.5
- CVE-2022-24980An issue was discovered in the Kitodo.Presentation (aka dif)…7.5
- CVE-2022-24981A reflected cross-site scripting (XSS) vulnerability in form…6.1
- CVE-2022-24982Forms generated by JQueryForm.com before 2022-02-05 allows a…6.5
- CVE-2022-24983Forms generated by JQueryForm.com before 2022-02-05 allow re…7.5
- CVE-2022-24984Forms generated by JQueryForm.com before 2022-02-05 (if file…9.8
- CVE-2022-24986KDE KCron through 21.12.2 uses a temporary file in /tmp when…7.8
- CVE-2022-24988In galois_2p8 before 0.1.2, PrimitivePolynomialField::new ha…9.8
- CVE-2022-24989TerraMaster NAS through 4.2.30 allows remote WAN attackers t…9.8
- CVE-2022-2499An issue has been discovered in GitLab EE affecting all vers…4.3
- CVE-2022-24990TerraMaster NAS 4.2.29 and earlier allows remote attackers t…7.5
- CVE-2022-24992A vulnerability in the component process.php of QR Code Gene…7.5
Are you affected by CVE-2022-24985?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST