PT-2022-26858 · Dzzoffice · Dzzoffice

Published 2022-10-27 · Updated 2022-10-31 · CVE-2022-43340

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dzzoffice version 2.02.1 SC UTF8

Description A Cross-Site Request Forgery (CSRF) issue allows attackers to create user accounts arbitrarily and grant Administrator rights to regular users.

Recommendations For dzzoffice version 2.02.1 SC UTF8, consider temporarily disabling user account creation functionality until a patch is available. Restrict access to Administrator rights to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-43340

Affected Products

Dzzoffice

References · 6

• 🔥 https://github.com/zyx0814/dzzoffice/issues/223 · Exploit
• https://osv.dev/vulnerability/CVE-2022-43340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43340 · Security Note
• https://github.com/zyx0814/dzzoffice · Note
• http://dzzoffice.com · Note
• https://t.me/cibsecurity/52176 · Telegram Post