CVE-2022-24985 json
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administ…
published 2022-02-16 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-29733
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server.
Patch / fix
- jqueryform jqueryform 2022-02-05
Exploit prediction
2.32% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
References
-
jqueryform.com
vendor-advisory
-
nou-systems.com
/cyber-security
third-party-advisory
-
gist.github.com
/pb-nsi/4d0a1ede76d4e97083b3435f820bf560
third-party-advisory
Sources
- CVE List CVE-2022-24985
- NVD CVE-2022-24985
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.