« Back to list

CVE-2022-45338

Status: ModifiedHigh (7.8)—

An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Exactsoftware — Exact Synergy

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-45338",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-45338",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-21T14:36:21.396527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-15T23:15:10.407",
  "references": [
    {
      "url": "https://gist.github.com/MaxRozendaal/633b34a4675b60caed736e5ffe28f272",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/MaxRozendaal/633b34a4675b60caed736e5ffe28f272",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de carga de archivos arbitrarios en la función de carga de imágenes de perfil de Exact Synergy Enterprise 267 anterior a 267SP13 y Exact Synergy Enterprise 500 anterior a 500SP6 permite a los atacantes ejecutar código arbitrario a través de un archivo SVG diseñado."
    }
  ],
  "lastModified": "2026-06-17T05:09:49.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:-:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BA9DEEE-EDE4-4B1A-8DB9-9E96CCA42489"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp1:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8F09D5D-C529-496B-ADB1-123C5A66AFB5"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp10:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABC81240-9458-4624-A4C1-2CB8C665E969"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp11:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDA14DD6-A17B-43FE-BA45-290A86418210"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp12:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD5E6FA6-C252-4078-AE10-CABBDDDFDF9B"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp2:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B33AF72-27CE-4C6A-A5C0-5ACB4B043E54"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp3:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "581CA5AA-E6AB-4693-A01B-23B6BD79CA6B"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp4:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE3AE6F3-4BB4-4BF1-8FBA-2FEE539F81FC"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp5:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "046D0970-3A43-49ED-AFFD-DADECA360E20"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp6:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "578F3276-2E44-4113-A00C-92486630438E"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp7:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1287BF67-6237-4883-A05E-7A227DFCD686"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp8:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBD1500E-CEAC-4894-9ED1-F884D174FB70"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:267:sp9:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D704BBC-1AA2-46DD-8E3E-FD1720032948"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:-:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1ABB366-F082-4F82-A498-51AFA46D3EE2"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp1:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AEFEF28-980E-4716-8649-4D379C637BC5"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp2:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA664DB4-D7F1-4B55-97CB-B20AD6BDB78F"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp3:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF9E5DB4-1DBC-4619-BDB9-2E519E3103EE"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp4:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "986FA7D8-EA82-4A33-93E2-47EEBD1257DB"
            },
            {
              "criteria": "cpe:2.3:a:exactsoftware:exact_synergy:500:sp5:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB8D464E-7A36-456A-8C3D-D077B3F62DD2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}