by Kastro
Paper/Archive/CVE-2022-24637

CVE-2022-24637

mitre — Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used t…

EPSS 99%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.9.999 × 2020.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdevel0pment.de/?p=2494refgithub.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4refpacketstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html