Read the docs
TI-2022-06826 Aliases CVE-2022-22552GHSA-h2m5-pc23-rcvh

Clickjacking in Dell AppSync

Priority LOW 32CWE-1021Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exploit this vulnerability to trick the victim into executing state changing operations.

Why it matters now

EPSS 0.00689 52nd percentileScored 2026-11-07
Fix Fixed AppSync (Dell): 4.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellAppSyncbefore 4.44.4Patch availableCNA
  • AppSync VendorDell Affected before 4.4 Fixed in 4.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_appsync:*:*:*:*:*:*:*:*before 4.4.0.0VulnerableDell
  • cpe:2.3:a:dell:emc_appsync:*:*:*:*:*:*:*:* Versions before 4.4.0.0 Vulnerable ·Dell

Remediation

  • Fix · CNA AppSync (Dell) Fixed in 4.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell AppSync 4.4

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-06827 Missing brute-force protection in Dell AppSyncPriority MEDIUM 44
    • TI-2022-06825 Session fixation in Dell AppSyncPriority LOW 38
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22552
  2. 2026-10-03 Alias added: GHSA-h2m5-pc23-rcvh

References

Patch 1

  • TI-2022-06827 Missing brute-force protection in Dell AppSync CVSS 3.1CRITICAL 9.8
  • TI-2022-06825 Session fixation in Dell AppSync CVSS 3.1HIGH 8.8
  • TI-2022-08300 Path traversal in Dell AppSync CVSS 3.1HIGH 7.5
  • TI-2024-15031 Sensitive information in log files in Dell AppSync CVSS 3.1MEDIUM 6.8
  • TI-2024-26518 XML external entity injection in Dell AppSync CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences