CVE-2022-45166

An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used to act on the data returned to the user. It allows a basic user to access data unrelated to their role.

Score

CVSS 3.1 6.5 Medium

Status

Modified - cve@mitre.org

Published

2023-01-10

Last modified

2025-05-30

Weaknesses

CWE-284

Affected products

• Archibus Web Central (Archibus)

References

• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45166
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-45166/