CVE-2022-45338
Summary
| CVE | CVE-2022-45338 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-12-15 23:15:00 UTC |
| Updated | 2022-12-21 14:20:00 UTC |
| Description | An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file. |
Risk And Classification
Problem Types: CWE-434
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Exactsoftware | Exact Synergy | 267 | - | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp1 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp10 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp11 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp12 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp2 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp3 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp4 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp5 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp6 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp7 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp8 | All | All |
| Application | Exactsoftware | Exact Synergy | 267 | sp9 | All | All |
| Application | Exactsoftware | Exact Synergy | 500 | - | All | All |
| Application | Exactsoftware | Exact Synergy | 500 | sp1 | All | All |
| Application | Exactsoftware | Exact Synergy | 500 | sp2 | All | All |
| Application | Exactsoftware | Exact Synergy | 500 | sp3 | All | All |
| Application | Exactsoftware | Exact Synergy | 500 | sp4 | All | All |
| Application | Exactsoftware | Exact Synergy | 500 | sp5 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2022-45338 - Stored XSS in Exact Synergy Enterprise · GitHub | MISC | gist.github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.