CVE-2022-37774

MediumCVSS 5.3

Published: 23/11/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

A broken access control vulnerability was found in Maarch RM 2.8.3. When previewing documents (PDF, email) from an archive, the application generates a URL containing an MD5 hash of the file, which is accessible without authentication.

Risk Assessment

An unauthorized person can access confidential documents stored in the archive, leading to data leakage and confidentiality breach.

Recommendation

Immediately update Maarch RM to the latest version and enforce authentication for all temporary resources.

Original NVD description (English source)

There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview is proposed by the application. This preview generates a URL including an md5 hash of the file accessed. The document's URL (https://{url}/tmp/{MD5 hash of the document}) is then accessible without authentication.