CVE-2022-36536 is a critical privilege escalation vulnerability affecting Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and earlier. Attackers can exploit a flaw in the post_applogin.php component to create crafted session tokens, gaining unauthorized access. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While not currently on the CISA KEV list or showing active in-the-wild exploitation, a Metasploit module exists for session token brute-forcing, indicating readily available exploit capabilities. Community discussion and media coverage are minimal, which is typical for the majority of CVEs.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.00, < 9.48jCPE matchmatch criteria | cpe:2.3:a:syncovery:syncovery:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.