CVE-2022-3549: oretnom23 simple_cold_storage_management_system Incorrect Privilege Assignment
Vulnerability summary
CVE-2022-3549 is a high (CVSS 7.2) Incorrect Privilege Assignment vulnerability in oretnom23 simple_cold_storage_management_system. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.5% of scored vulnerabilities.
Timeline
- 17-10-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.7MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.76%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.17 pp
From 0.59% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Oretnom231 product
Sourcecodester1 product
2 vendors · 2 products
References
2 links- github.com/Ramansh123454/POCs/blob/main/CSMS_RCEThird Party Advisory