CVE-2022-27498
Published: 15 December 2022
Summary
CVE-2022-27498 is a medium-severity Path Traversal (CWE-22) vulnerability in Lansweeper Lansweeper. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper 10.1.1.0. The flaw, tracked as CWE-22, permits an attacker to supply a specially crafted HTTP request that results in arbitrary file read from the underlying system. It carries a CVSS 3.1 base score of 6.5, reflecting network attack vector, low complexity, and low privileges required.
An authenticated attacker with low privileges can exploit the issue remotely by sending a crafted request to the affected endpoint, achieving disclosure of sensitive files without any user interaction. The vulnerability therefore exposes configuration data, credentials, or other restricted content stored on the Lansweeper server.
The primary public reference is the Talos Intelligence advisory TALOS-2022-1531, which details the vulnerability. The associated EPSS score has reached a peak of 0.4838 with a current value of 0.4473, indicating sustained moderate exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31999
Vulnerability details
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.