PT-2022-24481 · Unknown · Smartvista Cardgen

Tf1T + 1 · Published 2022-09-09 · Updated 2022-09-14 · CVE-2022-38614

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmartVista Cardgen version 3.28.0

Description The issue affects the IGB Files and OutfileService features, allowing attackers to list and download arbitrary files by modifying the PATH parameter.

Recommendations For SmartVista Cardgen version 3.28.0, consider restricting access to the IGB Files and OutfileService features until a patch is available. As a temporary workaround, avoid using the PATH parameter in the affected features to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-38614

Affected Products

Smartvista Cardgen

References · 6

• 🔥 https://tf1t.gitbook.io/mycve/smartvista/smartvista-cardgen/list-all-files-in-arbitrary-folder-in-smartvista-cardgen-version-3.28.0-cve-2022-38614 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38614 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38614 · Vendor Advisory
• http://bpcbt.com · Vendor Advisory
• https://t.me/cibsecurity/49546 · Telegram Post
• http://smartvista.com · Note