High severity · published Apr 22, 2023
CVE-2022-4944
kalcaddle KodExplorer cross-site request forgery
8.8
CVSS
2.7%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
KodExplorer · kalcaddle
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +34 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4944
Issue Tracking
https://github.com/kalcaddle/KodExplorer/issues/512
Release Notes
https://github.com/kalcaddle/KodExplorer/releases/tag/4.50
Third Party Advisory
https://vuldb.com/?ctiid.227000
Third Party Advisory
https://vuldb.com/?id.227000
Exploit
https://www.mediafire.com/file/709i2vxybergtg7/poc.zip/file
More from KodExplorer
9.8
CVE-2023-6853
kalcaddle KodExplorer app.php index server-side request forgery
9.8
CVE-2023-6852
kalcaddle KodExplorer app.php server-side request forgery
9.8
CVE-2023-6851
kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
9.8
CVE-2023-6850
kalcaddle KodExplorer API Endpoint unrestricted upload
8.1
CVE-2026-104081
KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction