CVE-2022-38176
Last modified
CVE-2022-38176 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. NOTE: this is not the same as CVE-2021-31859.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ysoft | Safeq | 6.0 |
References
- https://ysoft.comVendor Advisory
- https://ysoft.comVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-38176?
How severe is CVE-2022-38176?
How do I fix CVE-2022-38176?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38167The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XS…6.1
- CVE-2022-38168Broken Access Control in User Authentication in Avaya Scopia…9.1
- CVE-2022-3817A vulnerability has been found in Axiomatic Bento4 and class…6.5
- CVE-2022-38170In Apache Airflow prior to 2.3.4, an insecure umask was conf…4.7
- CVE-2022-38171Xpdf prior to version 4.04 contains an integer overflow in t…7.8
- CVE-2022-38172ServiceNow through San Diego Patch 3 allows XSS via the name…6.1
- CVE-2022-38177By spoofing the target resolver with responses that have a m…7.5
- CVE-2022-38178By spoofing the target resolver with responses that have a m…7.5
- CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect Fi…6.1
- CVE-2022-3818An uncontrolled resource consumption issue when parsing URLs…5.3
- CVE-2022-38180In JetBrains Ktor before 2.1.0 the wrong authentication prov…6.5
- CVE-2022-38181The Arm Mali GPU kernel driver allows unprivileged users to …8.8
Are you affected by CVE-2022-38176?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST