CVE-2022-36536

CriticalCVSS 9.8

Published: 16/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.82%

89th percentile - higher than 89% of all known CVEs

Summary

A vulnerability in the post_applogin.php component of Syncovery 9 for Linux version 9.47x and below allows attackers to escalate privileges by crafting malicious session tokens.

Risk Assessment

An attacker can gain unauthorized elevated access to the system, potentially leading to full control over the application and its data.

Recommendation

Immediately update Syncovery 9 for Linux to a version newer than 9.47x that includes a fix for this vulnerability.

Other vulnerabilities in Syncovery

See all

CVE-2022-36534High
Multiple remote code execution (RCE) vulnerabilities were discovered in Syncovery 9 for Linux version 9.47x and below via the Job_ExecuteBefore and Job_ExecuteAfter parameters in post_profilesettings.php.
CVE-2022-36533Medium
Syncovery 9 for Linux version 9.47x and below contains a cross-site scripting (XSS) vulnerability. This flaw could allow an attacker to inject malicious scripts into the user interface.

Original NVD description (English source)

An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens.