CVEvulnerability
CVE-2022-31887
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-06-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-522
Description
Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password.
Affected configurations
• marvalglobal marval msm 14.19.0.12476
Related
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/0-click-account-takeover Exploit, Third Party Advisory
- https://drive.google.com/drive/folders/12nb9KvckzhUNv4RtjlaeZi8QeFqwvkMX?usp=sharing Broken Link, Third Party Advisory
- https://marvalglobal.com/ Product
- https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/0-click-account-takeover Exploit, Third Party Advisory
- https://drive.google.com/drive/folders/12nb9KvckzhUNv4RtjlaeZi8QeFqwvkMX?usp=sharing Broken Link, Third Party Advisory
- https://marvalglobal.com/ Product