CVE-2022-47075

Deeper analysis

Smart Office Web versions 20.28 and earlier contain an information disclosure vulnerability that permits unauthenticated remote attackers to retrieve sensitive data by supplying crafted values to the action name parameter of ExportEmployeeDetails.aspx and ExportReportingManager.aspx. The flaw is reflected in a CVSS 3.1 base score of 7.5 and stems from missing authorization checks on these export endpoints.

An attacker with network access can directly invoke the affected endpoints without credentials or user interaction, resulting in the download of employee or reporting-manager details that should otherwise be restricted. The high EPSS score, currently 0.9205 with a recorded peak of 0.9253, indicates substantial exploitation interest following public disclosure.

Public references consist primarily of proof-of-concept listings and walkthroughs rather than vendor advisories; consequently no official patch or mitigation guidance is documented in the supplied sources. The consistently elevated EPSS values since publication suggest the issue has drawn sustained attention from potential threat actors.