CVE-2022-40319

EUVD-2022-43610
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Affected Products (NVD)
VendorProductVersion
lsoftlistserv
17.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://packetstormsecurity.com/2301-exploits/listserv17-idor.txt
https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L
https://packetstormsecurity.com/2301-exploits/listserv17-idor.txt
https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L