PT-2022-13989 · Scout · Scout

Northwestwitch · Published 2022-05-05 · Updated 2022-05-12 · CVE-2022-1592

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions scout versions prior to 4.42

Description The issue allows an attacker to make the application perform arbitrary requests, potentially leading to the theft of cookies, access to private areas, or cross-site scripting (xss).

Recommendations For versions prior to 4.42, update to version 4.42 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-1592

GHSA-G53G-Q539-93CV

Affected Products

Scout

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1592.json · Exploit
• 🔥 https://huntr.dev/bounties/352b39da-0f2e-415a-9793-5480cae8bd27 · Exploit
• https://github.com/clinical-genomics/scout/commit/b0ef15f4737d0c801154c1991b52ff5cab4f5c83 · Patch
• https://osv.dev/vulnerability/CVE-2022-1592 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g53g-q539-93cv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1592 · Security Note
• https://github.com/Clinical-Genomics/scout/issues/3325 · Note
• https://github.com/Clinical-Genomics/scout/pull/3326 · Note
• https://github.com/clinical-genomics/scout · Note
• https://t.me/cvenotify/30149 · Telegram Post
• https://t.me/cibsecurity/41970 · Telegram Post
• https://t.me/cvenotify/29711 · Telegram Post