CVE-2022-24387

File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

State: Published
Severity: 9.1 Critical
Published: Mar 14, 2022
Updated: May 5, 2026
Reserved: Feb 3, 2022

Description

With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	DIVD

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
SmarterTrackSmarterTools	100.0.8019.x to before Build 8075Affected

References

https://csirt.divd.nl/DIVD-2021-00029related
https://csirt.divd.nl/CVE-2022-24387/third-party-advisory
https://csrit.divd.nl/CVE-2022-24387third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.