{"id":"CVE-2022-22279","published":"2022-04-13T05:35:09Z","modified":"2024-08-03T03:07:50Z","title":"A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and…","vendor":"SonicWall","product":"SonicWall SRA/SMA100","tier":"core","eol":null,"affectedVersions":[{"vendor":"SonicWall","product":"SonicWall SRA/SMA100","versions":["SRA Series 9.0.0.5-19sv and earlier versions.","SMA100 Series 9.0.0.9-26sv and earlier versions."]}],"description":{"text":"A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.01111,"percentile":0.65865,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-05-15","exploitedFirstSeen":"2023-05-15","ransomware":true,"evidence":[{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Vulnerability in Multiple SonicWall Products","url":"https://otx.alienvault.com/pulse/6281f600dc18db5d889c63e7","created":"2022-05-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0006","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-27426","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27426","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-04-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-22279","provenance":"source"},{"date":"2023-05-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":58.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1263 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":13.17,"detail":"percentile 0.6586"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}