CVE-2022-37177
Last modified
CVE-2022-37177 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hirevue | Hiring Platform | All versions |
References
- https://github.com/JC175/CVE-2022-37177Exploit, Third Party Advisory
- https://www.hirevue.com/Vendor Advisory
- https://github.com/JC175/CVE-2022-37177Exploit, Third Party Advisory
- https://www.hirevue.com/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-37177?
How severe is CVE-2022-37177?
How do I fix CVE-2022-37177?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-37164Inoda OnTrack v3.4 employs a weak password policy which allo…9.8
- CVE-2022-3717Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-37172Incorrect access control in the install directory (C:\msys64…7.8
- CVE-2022-37173An issue in the installer of gvim 9.0.0000 allows authentica…7.8
- CVE-2022-37175Tenda ac15 firmware V15.03.05.18 httpd server has stack buff…9.8
- CVE-2022-37176Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below cont…9.8
- CVE-2022-37178An issue was discovered in 72crm 9.0. There is a SQL Injecti…8.8
- CVE-2022-3718Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-3718172crm 9.0 has an Arbitrary file upload vulnerability.9.8
- CVE-2022-37183Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) vi…6.1
- CVE-2022-37184The application manage_website.php on Garage Management Syst…8.8
- CVE-2022-37185SQL injection vulnerability exists in the school information…7.5
Are you affected by CVE-2022-37177?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST