PT-2022-15679 · Synel · Synel

Published 2022-01-28 · Updated 2022-02-02 · CVE-2022-22790

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SYNEL - eharmony (affected versions not specified)

Description The issue allows an attacker to perform a Directory Traversal attack, which is aimed at gaining unauthorized access to the file system. By manipulating the Name parameter, an attacker can return to the root directory and access the host file, exposing sensitive files that users upload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-22790

Affected Products

Synel

References · 3

• https://osv.dev/vulnerability/CVE-2022-22790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22790 · Security Note
• https://gov.il/en/departments/faq/cve_advisories · Note