CVE-2022-36536
CRITICALSyncovery <9.47x - Privilege Escalation
Title source: llmDescription
An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens.
Exploits (1)
metasploit
SCANNER
by Jan Rude · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/syncovery_linux_token_cve_2022_36536.rb
Scores
CVSS v3
9.8
EPSS
0.4801
EPSS Percentile
97.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-330
Status
published
Products (1)
syncovery/syncovery
8.00 - 9.48j
Published
Sep 16, 2022
Tracked Since
Feb 18, 2026