Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2022-25268: Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
CVE-2022-25268 · published 4 years ago
Summary
Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
What to do
- Update passwork passwork to version 4.6.13 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| passwork | passwork |
< 4.6.13 cpe:2.3:a:passwork:passwork:*:*:*:*:on-premise:*:*:* |
Original advisory text
Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
References
- https://gist.github.com/garakh/e0e2fe6d6e234f0595dea6a8141568f2 Third Party Advisory
- https://passwork.me Product Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published23 Mar 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-25268 · NVD
Track software like this
Free during beta