CVE-2022-22832

Deeper analysis

Servisnet Tessa version 0.0.2 contains an authorization exposure vulnerability tracked as CVE-2022-22832. The flaw allows any party to retrieve authorization data by issuing an unauthenticated HTTP request to the /data-service/users/ endpoint. The issue carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack complexity that requires no credentials or user interaction and yields complete loss of confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the endpoint to obtain sensitive authorization information, which can then be leveraged to escalate privileges or fully compromise the affected Tessa instance. Public exploit code demonstrating the request and subsequent privilege escalation has been available since disclosure.

The EPSS score for this CVE rose from low values after the 2022 publication to a peak of 0.4424 on 2025-01-22 before receding to the current 0.2335, indicating renewed exploitation interest well after initial release. Multiple proof-of-concept listings on Exploit-DB and Packet Storm confirm that working attack material has been shared publicly.