CVE-2022-47075

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

59.41% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high

Published

2023-02-28

Updated

2025-03-18

Proof-of-concept exploits (1)

• https://cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47075.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51539

References

• CVE Record
• NVD entry

Related

• CVE-2022-47072
• CVE-2022-47076
• CVE-2022-47070
• CVE-2022-47083
• CVE-2022-47069
• CVE-2022-47086