PT-2022-24064 · Maarch Rm · Maarch Rm

François Mehault · Published 2022-11-22 · Updated 2025-04-29 · CVE-2022-37774

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Maarch RM version 2.8.3

Description The issue concerns a broken access control vulnerability. When accessing specific documents, such as PDFs or emails, from an archive, the application proposes a preview. This preview generates a URL that includes an MD5 hash of the accessed file. The document's URL, in the format https://{url}/tmp/{MD5 hash of the document}, becomes accessible without requiring authentication.

Recommendations For Maarch RM version 2.8.3, consider restricting access to the preview feature until a patch is available, or implement an additional authentication mechanism for the generated URLs to prevent unauthorized access.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-37774

Affected Products

Maarch Rm

References · 7

• 🔥 https://github.com/frame84/vulns/blob/main/MaarchRM/CVE-2022-37774/README.md · Exploit
• http://maarch.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37774 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37774 · Vendor Advisory
• https://t.me/cvenotify/38516 · Telegram Post
• https://t.me/cvenotify/120143 · Telegram Post
• https://t.me/cvenotify/38282 · Telegram Post