PT-2022-15703 · Overit · Overit Geocall

Davide Bassetto · CVE-2022-22835 · Published 2022-03-07 · Updated 2024-09-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OverIT Geocall versions prior to 8.0

Description An issue was discovered that allows an authenticated user with the Test Trasformazione XSL functionality enabled to exploit a vulnerability. This can lead to reading arbitrary files from the filesystem. Additionally, attackers could exploit this issue to achieve remote code execution.

Recommendations For versions prior to 8.0, update to version 8.0 or later to resolve the issue. As a temporary workaround, consider disabling the Test Trasformazione XSL functionality to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-22835

Affected Products

Overit Geocall

References · 8

• 🔥 https://labs.yarix.com/2022/03/overit-framework-xslt-injection-and-xxe-cve-2022-22834-cve-2022-22835 · Exploit
• https://osv.dev/vulnerability/CVE-2022-22835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22835 · Security Note
• https://overit.us/products/geocall · Vendor Advisory
• https://overit.ai/product/nextgen-fsm · Note
• https://labs.yarix.com/advisories/cve-2022-22835 · Note
• https://t.me/cvenotify/95149 · Telegram Post
• https://t.me/cvenotify/35686 · Telegram Post