CVE-2022-2420

URVE Web Manager uploader.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.

Affected

URVE · Web Manager

CVSS v3.1 NVD

8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.13% chance of exploitation in the next 30 days, 66th percentile

Published

2022-07-15

Updated

2025-04-15

Proof-of-concept exploits (1)

• joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20uploader.php%20%20File%20uploa…0★ · 2025-09-04

Security advisories

• https://vuldb.com/?id.203903

References

• CVE Record
• NVD entry

Related

• CVE-2022-1503
• CVE-2022-1590
• CVE-2022-2086
• CVE-2022-2087
• CVE-2022-2418
• CVE-2022-2419