Vulnerabilities

TI-2022-08263 CVE-2022-24387 · GHSA-38pg-fhjw-6gv5

File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

MEDIUM 45

With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02058 Published 2022-03-14 Fixed in Build 8075 CWE-434

TI-2022-08262 CVE-2022-24386 · GHSA-jc69-7qfh-4gh7

Stored XSS in SmarterTrack v100.0.8019.14010

LOW 39

Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00708 Published 2022-03-14 Fixed in Build 8075 CWE-79

TI-2022-08261 CVE-2022-24385 · GHSA-w772-882m-xx33

Information disclosure via direct object access on SmarterTrack v100.0.8019.14010

LOW 30

A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00877 Published 2022-03-14 Fixed in Build 8075 CWE-425

TI-2022-08260 CVE-2022-24384 · GHSA-fhxg-444p-h63x

Reflective XSS on SmarterTrack v100.0.8019.14010

MEDIUM 47

Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0409 Published 2022-03-14 Fixed in Build 8075 CWE-79

Vulnerabilities

Filters

File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

Stored XSS in SmarterTrack v100.0.8019.14010

Information disclosure via direct object access on SmarterTrack v100.0.8019.14010

Reflective XSS on SmarterTrack v100.0.8019.14010