CVE-2022-30280
highpriority · track · 35EPSS 0.005 · 41 %ileEUUSEPSS · scored 2026-10-27
/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application (even if it implements a CSRF token for the random GET request) does not ever verify a CSRF token. With a little help of social engineering/phishing (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-30280/cnnvd
- https://www.gruppotim.it/it/footer/red-team.htmlcnnvd
- https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlcnnvd
- https://www.gruppotim.it/it/footer/red-team.htmlenisa_euvd
- https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlenisa_euvd
- https://www.gruppotim.it/it/footer/red-team.htmlExploitThird Party Advisorynvd
- https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlNot Applicablenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan