{"id":"CVE-2022-38123","aliases":["EUVD-2022-40725","GHSA-q365-6hx4-82gp"],"status":"published","title":"Insufficient validation of plugin files","description":"Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\n\nThis issue affects:\n\nSecomea GateManager\n\nversions prior to 10.0.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00812,"percentile":0.57413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2022-12-06T15:58:01Z","modified":"2026-06-17T04:56:08Z","products":[{"vendor":"secomea","product":"gatemanager"}],"references":[{"url":"https://www.secomea.com/support/cybersecurity-advisory/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38123"},{"url":"https://github.com/advisories/GHSA-q365-6hx4-82gp"}],"sources":{"cve":[{"id":"CVE-2022-38123","title":"Insufficient validation of plugin files","description":"Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\n\nThis issue affects:\n\nSecomea GateManager\n\nversions prior to 10.0.\n\n\n\n","status":"published","published":"2022-12-06T15:58:01.365Z","modified":"2025-04-23T16:12:37.744Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-40725","description":"Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\n\nThis issue affects:\n\nSecomea GateManager\n\nversions prior to 10.0.\n\n\n\n","status":"published","published":"2022-12-06T15:58:01Z","modified":"2025-04-23T16:12:37Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:13.204099Z"}],"ghsa":[{"id":"GHSA-q365-6hx4-82gp","title":"Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager...","description":"Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.","status":"published","published":"2022-12-06T18:30:19Z","modified":"2023-02-02T05:02:55Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:51:32.364862Z"}],"nvd":[{"id":"CVE-2022-38123","description":"Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.\n\nThis issue affects:\n\nSecomea GateManager\n\nversions prior to 10.0.\n\n\n\n","status":"published","published":"2022-12-06T16:15:10.567Z","modified":"2026-06-17T04:56:08.943Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:33.239526Z"}]}}