CVE-2022-22828 Missing authorization in n/a

High 7.5 Published 27 Jan 2022 Updated 3 Aug 2024

Remote attackers can access unshared files by modifying base64-encoded filenames in download URLs, exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-22828?

CVE-2022-22828 is a high-severity missing authorization vulnerability in n/a, published on 27 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.

Weakness: CWE-639

Which versions are affected by CVE-2022-22828?

It affects 1 product.

Products include Synametrics Synaman.

How do I fix CVE-2022-22828?

No fix has been published for CVE-2022-22828 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-22828 being exploited?

There is no known exploitation of CVE-2022-22828 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-2r36-2m2v-4gwc.