« Volver al listado

CVE-2022-45338

Estado: ModificadaAlta (7.8)—

Una vulnerabilidad de carga de archivos arbitrarios en la función de carga de imágenes de perfil de Exact Synergy Enterprise 267 anterior a 267SP13 y Exact Synergy Enterprise 500 anterior a 500SP6 permite a los atacantes ejecutar código arbitrario a través de un archivo SVG diseñado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Exactsoftware — Exact Synergy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-45338",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-45338",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-21T14:36:21.396527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-15T23:15:10.407",
  "references": [
    {
      "url": "https://gist.github.com/MaxRozendaal/633b34a4675b60caed736e5ffe28f272",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/MaxRozendaal/633b34a4675b60caed736e5ffe28f272",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de carga de archivos arbitrarios en la función de carga de imágenes de perfil de Exact Synergy Enterprise 267 anterior a 267SP13 y Exact Synergy Enterprise 500 anterior a 500SP6 permite a los atacantes ejecutar código arbitrario a través de un archivo SVG diseñado."
    }
  ],
  "lastModified": "2026-06-17T05:09:49.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:-:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BA9DEEE-EDE4-4B1A-8DB9-9E96CCA42489"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp1:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8F09D5D-C529-496B-ADB1-123C5A66AFB5"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp10:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABC81240-9458-4624-A4C1-2CB8C665E969"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp11:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDA14DD6-A17B-43FE-BA45-290A86418210"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp12:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD5E6FA6-C252-4078-AE10-CABBDDDFDF9B"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp2:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B33AF72-27CE-4C6A-A5C0-5ACB4B043E54"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp3:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "581CA5AA-E6AB-4693-A01B-23B6BD79CA6B"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp4:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE3AE6F3-4BB4-4BF1-8FBA-2FEE539F81FC"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp5:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "046D0970-3A43-49ED-AFFD-DADECA360E20"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp6:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "578F3276-2E44-4113-A00C-92486630438E"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp7:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1287BF67-6237-4883-A05E-7A227DFCD686"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp8:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBD1500E-CEAC-4894-9ED1-F884D174FB70"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp9:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D704BBC-1AA2-46DD-8E3E-FD1720032948"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:-:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1ABB366-F082-4F82-A498-51AFA46D3EE2"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp1:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AEFEF28-980E-4716-8649-4D379C637BC5"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp2:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA664DB4-D7F1-4B55-97CB-B20AD6BDB78F"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp3:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF9E5DB4-1DBC-4619-BDB9-2E519E3103EE"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp4:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "986FA7D8-EA82-4A33-93E2-47EEBD1257DB"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp5:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB8D464E-7A36-456A-8C3D-D077B3F62DD2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}