CVE-2022-43340

HighCVSS 8.8

Published: 27/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.

Risk Assessment

The risk involves unauthorized takeover of the system, potentially leading to data theft, configuration changes, or full compromise of the dzzoffice instance.

Recommendation

Immediately update dzzoffice to the latest version and implement CSRF protections such as anti-CSRF tokens and Origin header verification.

Other vulnerabilities in dzzoffice

See all

CVE-2025-63695Critical
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
CVE-2025-63694Critical
DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.

Original NVD description (English source)

A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.