Read the docs
TI-2022-08263 Aliases CVE-2022-24387GHSA-38pg-fhjw-6gv5

File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

Priority MEDIUM 45CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02058 81st percentileScored 2026-11-07
Fix Fixed SmarterTrack (SmarterTools): Build 8075

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SmarterToolsSmarterTrack100.0.8019.x to before Build 8075Build 8075Patch availableCNA
  • SmarterTrack VendorSmarterTools Affected 100.0.8019.x to before Build 8075 Fixed in Build 8075 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*100.0.8019 to before 100.0.8075VulnerableSmarterTools
  • cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:* Versions 100.0.8019 to before 100.0.8075 Vulnerable ·SmarterTools

Remediation

  • Fix · CNA SmarterTrack (SmarterTools) Fixed in Build 8075

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SmarterTools SmarterTrack Build 8075

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-08260 Reflective XSS on SmarterTrack v100.0.8019.14010Priority MEDIUM 47
    • TI-2022-08262 Stored XSS in SmarterTrack v100.0.8019.14010Priority LOW 39
    • TI-2022-08261 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010Priority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24387
  2. 2026-10-03 Alias added: GHSA-38pg-fhjw-6gv5

References

Advisory 2

  • TI-2020-19061 SmarterTools SmarterTrack 7922 -Information Disclosure CVSS 4.0MEDIUM 6.9
  • TI-2022-08260 Reflective XSS on SmarterTrack v100.0.8019.14010 CVSS 3.1HIGH 8.8
  • TI-2022-08262 Stored XSS in SmarterTrack v100.0.8019.14010 CVSS 3.1HIGH 8.8
  • TI-2022-08261 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010 CVSS 3.1MEDIUM 6.5
  • TI-2009-04751 Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack… CVSS 2.0MEDIUM 4.3
  • TI-2009-04750 Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences