CVE-2022-24637

Katalog CVE

CVSS 9.8 · Critical EPSS 99,1%

Kerentanan Improper Privilege Management pada openwebanalytics open web analytics. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

Rincian

Terbit di NVD

18 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

99,1% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://devel0pment.de/?p=2494 exploit · mitigasi · patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4 release notes · advisory pihak ketiga
• http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html