Is CVE-2022-23173 actively exploited?

No active exploitation of CVE-2022-23173 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-23173 be exploited remotely?

Yes. CVE-2022-23173 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-23173?

CVE-2022-23173 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2022-23173

MEDIUM

CVE-2022-23173

CWE-639Published: July 6, 2022· Updated: Jun 17, 2026

6.3

CVSS v3.1

Official Description

this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get an answer that he is not authorized because he needs to log in with credentials. after he performed log in to the system there are some functionalities that the specific user is not allowed to perform because he was configured with low privileges however all the attacker need to do in order to achieve his goals is to change the value of the prog step parameter from 0 to 1 or more and then the attacker could access to some of the functionality the web application that he couldn't perform it before the parameter changed.

NVD Source

Technical Analysis

CVE-2022-23173 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.