PT-2022-15707 · Formpipe · Formpipe Lasernet

Alex Clemons · Published 2022-01-10 · Updated 2022-01-18 · CVE-2022-22847

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Formpipe Lasernet versions prior to 9.13.3

Description The issue allows file inclusion in Client Web Services, which can be exploited by an authenticated attacker or in configurations where authentication is not required.

Recommendations For versions prior to 9.13.3, update to version 9.13.3 or later to resolve the issue.

Fix

Related Identifiers

CVE-2022-22847

Affected Products

Formpipe Lasernet

References · 3

• https://osv.dev/vulnerability/CVE-2022-22847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22847 · Security Note
• https://support.formpipe.com/news/posts/vulnerability-in-the-client-web-service-of-lasernet-9-and-older · Vendor Advisory