CVE-2022-38756

🗓️ 16 Dec 2022 00:00:00Reported by microfocusType

cve🔗 web.nvd.nist.gov👁 62 Views🌐 WEB

A vulnerability in Micro Focus GroupWise Web allows logging of sensitive information by HTTP proxies

Reporter	Title	Published	Views	Family All 11
0day.today	Micro Focus GroupWise Session ID Disclosure Vulnerability	30 Jan 202300:00	–	zdt
Circl	CVE-2022-38756	17 Dec 202202:24	–	circl
CNNVD	Micro Focus GroupWise 日志信息泄露漏洞	16 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-38756 CVE-2022-38756 vulnerability in GW Web prior to 18.4.2	16 Dec 202200:00	–	cvelist
EUVD	EUVD-2022-41319	3 Oct 202520:07	–	euvd
NVD	CVE-2022-38756	16 Dec 202223:15	–	nvd
Packet Storm	Micro Focus GroupWise Session ID Disclosure	27 Jan 202300:00	–	packetstorm
Prion	Design/Logic Flaw	16 Dec 202223:15	–	prion
Positive Technologies	PT-2022-24554 · Micro Focus · Micro Focus Groupwise Web	16 Dec 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-38756	22 May 202521:49	–	redhatcve

NVD

Node

microfocus groupwiseRange<18.4.2

[
  {
    "vendor": "Micro Focus",
    "product": "Micro Focus GroupWise Web",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "18.4.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
portal	www.portal.microfocus.com/s/article/KM000012374
seclists	www.seclists.org/fulldisclosure/2023/Jan/28
packetstormsecurity	www.packetstormsecurity.com/files/170768/Micro-Focus-GroupWise-Session-ID-Disclosure.html
seclists	www.seclists.org/fulldisclosure/2023/Jan/28
packetstorm	www.packetstorm.news/files/id/170768

Parameter	Position	Path	Description	CWE
session	query param	/attachment	Session ID transmitted in URL query parameters (GET) exposing session to logging/history.	CWE-532
id	query param	/attachment	Session ID transmitted in URL query parameters (GET) exposing session to logging/history.	CWE-532

18 Apr 2025 14:15Current

4.3Medium risk

Vulners AI Score4.3

CVSS 3.14.3

EPSS0.00184

SSVC

CWE-532