PT-2026-2177 · Unknown · Opexus Ecomplaint

Zach Crosman · Publicado 2026-01-08 · Atualizado 2026-02-18 · CVE-2026-22235

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint versions prior to 9.0.45.0

Description The application allows an attacker to access the 'DocumentOpen.aspx' endpoint and potentially download any uploaded files. This is possible by iterating through predictable values of the chargeNumber parameter.

Recommendations Update OPEXUS eComplaint to version 9.0.45.0 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-22235

Produtos afetados

Opexus Ecomplaint

Referências · 8

• https://osv.dev/vulnerability/CVE-2026-22235 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009462342850105845 · Publicação no Twitter
• https://t.me/cveNotify/152319 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2026-22235 · Nota de Segurança
• https://t.me/CVEtracker/41754 · Publicação no Telegram
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json · Nota
• https://twitter.com/VulmonFeeds/status/2009477611945079190 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22235 · Nota de Segurança