High severity · published Feb 7, 2022
CVE-2022-23320
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XU
Xmpie Ustore · Xerox
12.3.7244.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23320
Third Party Advisory
https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29
Exploit
https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/
Release Notes
https://www.xmpie.com/ustore-release-notes/
More from Xmpie Ustore
4.8
CVE-2022-23321
A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version…