CVE-2022-27192

HIGH

DVS Avilys < 3.5.58 - Unauthenticated Sensitive Information Exposure via Reporting Module

Title source: llm
STIX 2.1

Description

The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0110
EPSS Percentile 61.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-532
Status published
Products (1)
asseco/dvs_avilys < 3.5.58
Published Mar 23, 2022
Tracked Since Feb 18, 2026