CVE-2022-22831

Deeper analysis

CVE-2022-22831 is an authentication bypass vulnerability in Servisnet Tessa version 0.0.2 that stems from improper handling of the Authorization HTTP header. The flaw, tracked under CWE-287, permits an unauthenticated remote attacker to create a new sysadmin account and obtain full administrative control over the affected system. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker can exploit the issue simply by sending a crafted HTTP request that manipulates the Authorization header, resulting in the addition of a privileged user without any prior authentication. Successful exploitation grants complete control of the application, including the ability to manage other accounts and system configuration.

Publicly available references consist of exploit code and proof-of-concept reports on sites such as Exploit-DB and Packet Storm; none of the listed sources describe vendor patches, workarounds, or official mitigation guidance.

The EPSS score has remained flat at 0.2124 with no material increase after disclosure, and no information on observed in-the-wild exploitation is provided.