CVE-2022-30354

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-30354
OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-30354 Third Party Advisory Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:ovaledge:ovaledge:*:*:*:*:*:*:*:*
History

23 Apr 2025, 00:42

Type Values Removed Values Added
References () https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-30354 - () https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-30354 - Third Party Advisory, Exploit
CPE cpe:2.3:a:ovaledge:ovaledge:*:*:*:*:*:*:*:*
First Time Ovaledge
Ovaledge ovaledge

21 Nov 2024, 07:02

Type Values Removed Values Added
CWE CWE-732
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

28 Oct 2024, 13:58

Type Values Removed Values Added
Summary
  • (es) OvalEdge 5.2.8.0 y versiones anteriores se ven afectadas por una vulnerabilidad de exposición de datos confidenciales a través de una solicitud GET a /user/getUserWithTeam. Se requiere autenticación. La información divulgada está asociada con todos los números de identificación de usuario registrados.

25 Oct 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-25 16:15

Updated : 2025-04-23 00:42

NVD link : CVE-2022-30354

Mitre link : CVE-2022-30354

CVE.ORG link : CVE-2022-30354

JSON object : View

Products Affected

ovaledge

  • ovaledge
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource