CVE-2022-39042 aEnrich a+HRD - Improper Authentication

What is CVE-2022-39042?

CVE-2022-39042 is a critical authentication bypass vulnerability in aEnrich a+HRD, published on 3 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service.

Weakness: CWE-287

Which versions are affected by CVE-2022-39042?

It affects 1 product.

Products include Aenrich A\+hrd.

How do I fix CVE-2022-39042?

No fix has been published for CVE-2022-39042 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-39042 being exploited?

There is no known exploitation of CVE-2022-39042 in the wild and no public exploit code.

Other vulnerabilities in aEnrich a+HRD

• CVE-2025-0585 aEnrich Technology a+HRD - SQL Injection Critical 9.8
• CVE-2023-20852 aEnrich a+HRD - Deserialization of Untrusted Data Critical 9.8
• CVE-2023-20853 aEnrich a+HRD - Deserialization of Untrusted Data Critical 9.8
• CVE-2022-39039 aEnrich a+HRD - Server-Side Request Forgery (SSRF) Critical 9.8
• CVE-2022-39041 aEnrich a+HRD - SQL Injection Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h8vp-rf22-chjr.