CVE-2022-44022 Information disclosure in n/a
Remote attackers can identify valid user account names by analyzing response timings during authentication attempts in PwnDoc.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-44022?
CVE-2022-44022 is a medium-severity vulnerability in n/a, published on 29 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts.
Weakness: CWE-307
Which versions are affected by CVE-2022-44022?
It affects 1 product.
Products include Pwndoc Project Pwndoc.
How do I fix CVE-2022-44022?
No fix has been published for CVE-2022-44022 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-44022 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44022 exists.
Other vulnerabilities in n/a
- CVE-2022-45771 File upload in n/a
- CVE-2021-31590 Auth bypass in n/a
- CVE-2024-55602 PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal
- CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
- CVE-2025-27410 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin
Sources
Also known as GHSA-rxj6-c9ph-rrrh.