Read the docs
TI-2022-07328 Aliases CVE-2022-23172GHSA-w7v3-573j-vhr9

Priority - Priority User Enumeration

Priority LOW 25CWE-640Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.

Why it matters now

EPSS 0.00452 39th percentileScored 2026-11-07
Fix Fixed Priority (Priority): 22.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PriorityPriority22.0 to before 22.022.0Patch availableCNA
  • Priority VendorPriority Affected 22.0 to before 22.0 Fixed in 22.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:priority-software:priority:*:*:*:*:*:*:*:*before 22.0VulnerablePriority
  • cpe:2.3:a:priority-software:priority:*:*:*:*:*:*:*:* Versions before 22.0 Vulnerable ·Priority

Remediation

  • Fix · CNA Priority (Priority) Fixed in 22.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23172
  2. 2026-10-03 Alias added: GHSA-w7v3-573j-vhr9

References

Advisory 1

  • TI-2023-09302 Priority Web – Authentication bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-09301 Priority Windows – Command Execution via SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2024-27759 Priority – CWE-552: Files or Directories Accessible to External Parties CVSS 3.1HIGH 7.5
  • TI-2024-27758 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS 3.1HIGH 7.5
  • TI-2022-07329 Priority - Priority web Insecure direct object references (IDOR) CVSS 3.1MEDIUM 6.3
  • TI-2024-27757 Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences