Security readout for executives and security teams
Plain-English summary
BigAnt Server v5.6.06 is reported to have an incorrect access control issue. In business terms, some protected function or data may not enforce authorization correctly. The source bundle does not provide CVSS, CWE, detailed impact, or a vendor fix, so urgency depends on whether this exact product and version is deployed.
Executive priority
Prioritize verification if BigAnt Server is used, especially if externally accessible. This is not KEV-listed in the bundle, but access-control flaws can affect confidentiality or integrity, and the public PoC reference justifies timely triage.
Technical view
CVE-2022-23345 describes incorrect access control in BigAnt Software BigAnt Server v5.6.06. The bundle identifies a public GitHub PoC reference and the vendor site, but does not include exploit mechanics, affected CPEs, CVSS, CWE, or remediation details. CISA KEV status is false in the provided bundle.
Likely exposure
Exposure is likely limited to organizations running BigAnt Server v5.6.06. The bundle does not identify other affected versions, deployment conditions, or vulnerable components. Internet-exposed or broadly reachable servers would carry higher operational risk.
Exploitation context
The provided data does not support active exploitation. A public GitHub proof-of-concept reference is listed, which may increase researcher and attacker awareness, but the bundle does not confirm real-world exploitation or weaponized use.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPEs, impact detail, or patch information are included. The only specific affected version named is BigAnt Server v5.6.06. Published date is 2022-03-21; bundle update is 2026-07-09. Avoid assuming broader version impact.
Mitigation direction
- Inventory systems for BigAnt Server and confirm any v5.6.06 deployments.
- Check BigAnt Software guidance for fixed versions or official mitigations.
- Restrict network reachability to trusted users and management networks where operationally possible.
- Review application logs for unauthorized access patterns around sensitive functions.
- Plan replacement or isolation if the version is unsupported or cannot be remediated.
Validation and detection
- Confirm installed BigAnt Server versions through approved asset management records.
- Identify whether any BigAnt Server instance is internet-facing or broadly reachable.
- Review vendor advisories or release notes for CVE-2022-23345 remediation details.
- Validate authorization behavior only in approved test environments.
- Document compensating controls if no vendor patch is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-23345 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23345CVE reference, mitre
- https://www.bigantsoft.com/CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.