CVE-2022-23858
In StarWind Command Center before V2 build 6021, an authenticated read-only user can elevate...
CVE-2022-23858 is a high vulnerability (CVSS 8.8) in Starwindsoftware Command Center, published January 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. No source names a fixed version.
A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.
- Record
CVE-2022-23858- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.
- Record
CVE-2022-23858- Updated
- 2026-11-02
EUVDEUVD-2022-28783 No score
A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.
- Record
EUVD-2022-28783- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2gfj-wm5m-4vc3
In StarWind Command Center before V2 build 6021, an authenticated read-only user can elevate...
In StarWind Command Center before V2 build 6021, an authenticated read-only user can elevate privileges to administrator through the REST API.
- Record
GHSA-2gfj-wm5m-4vc3- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |