CVE-2022-23767

hanssak securegate, hanssak weblink

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-23767

Katalog CVE

CVSS 9.8 · Critical EPSS 0,97%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada hanssak securegate, hanssak weblink. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.

Rincian

Terbit di NVD
19 September 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-288: Authentication Bypass Using an Alternate Path or Channel
EPSS (30 hari)
0,97% peluang dieksploitasi; lebih tinggi dari 60,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
hanssak securegate Versi 3.5
hanssak weblink Versi 3.5.2 hingga 3.5.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.