CVEvulnerability
CVE-2022-23320
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-07
- Last modified
- 2026-07-09
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-287
Description
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.
Affected configurations
• xerox xmpie ustore 12.3.7244.0
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29 Third Party Advisory
- https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/ Exploit, Third Party Advisory
- https://www.xmpie.com/ustore-release-notes/ Release Notes, Vendor Advisory
- https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29 Third Party Advisory
- https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/ Exploit, Third Party Advisory
- https://www.xmpie.com/ustore-release-notes/ Release Notes, Vendor Advisory