CVE-2022-31324

Published: Sep 13, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to download arbitrary files via a crafted POST request.

Affected (3)

Products: Pentasecurity: Wapples

Pentasecurity

1 product

Wapples

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pentasecurity Wapples	From 4.0.0 to 6.0.r3.4.10
Pentasecurity Wapples	Version v6.0.r3.4.10
Pentasecurity Wapples	Version v6.0.r3.4.10 hotfix1

Related CWEs

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (4)

https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb

Source: cve@mitre.org

https://www.pentasecurity.com/product/wapples/

Source: cve@mitre.org

Vendor Advisory

https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.pentasecurity.com/product/wapples/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.