Medium severity · published Nov 2, 2022
CVE-2022-3826
Huaxia ERP Retail Management list information disclosure
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retail Management. The manipulation of the argument search leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212793 was assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
ERP · Huaxia
All versions, or not specified · source: vendor
HE
Huaxia Erp · Huaxiaerp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3826
Exploit
https://github.com/Ha0Liu/cveAdd/blob/developer/README.EN.yuequan.md
Permissions Required
https://vuldb.com/?id.212793
More from ERP
7.5
CVE-2024-0491
Huaxia ERP UserController.java password recovery
7.5
CVE-2024-0490
Huaxia ERP getAllList information disclosure
6.5
CVE-2022-3825
Huaxia ERP User Management sql injection