CVE-2022-3458: oretnom23 human_resource_management_system Incorrect Privilege Assignment
Vulnerability summary
CVE-2022-3458 is a critical (CVSS 9.8) Incorrect Privilege Assignment vulnerability in oretnom23 human_resource_management_system. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.4% of scored vulnerabilities.
Timeline
- 12-10-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210559.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.05 pp
From 0.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Oretnom231 product
Sourcecodester1 product
2 vendors · 2 products
References
1 links- vuldb.com?id.210559Third Party Advisory