Security readout for executives and security teams
Plain-English summary
URVE Web Manager has a critical unrestricted file upload issue in _internal/collector/upload.php. A low-privileged actor on the local or adjacent network could abuse upload handling, potentially affecting confidentiality, integrity, and availability. The provided sources do not name fixed versions or vendor mitigation.
Executive priority
Treat this as a high-priority internal exposure issue. The risk is serious because successful abuse could compromise the Web Manager host, but provided evidence limits the expected attack path to local or adjacent network access.
Technical view
CVE-2022-2419 is CWE-434 in URVE Web Manager upload.php. The CVSS 3.1 vector is AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.0. Affected versions are not specified. Public exploit disclosure is reported, but KEV status is false in the bundle.
Likely exposure
Exposure is most likely where URVE Web Manager is reachable from internal, adjacent, or local network segments and low-privileged accounts exist. Internet exposure is not established by the provided sources. Version-level exposure cannot be narrowed because affected versions are listed as n/a.
Exploitation context
The source bundle states that exploit details were publicly disclosed and may be used. It also states local network access is required. There is no provided evidence of confirmed active exploitation or CISA KEV listing, so active exploitation should not be assumed.
Researcher notes
Evidence is incomplete on affected versions, patch status, and real-world exploitation. Prioritize asset discovery, network scoping, authentication review, and vendor-advisory tracking. Avoid assuming a specific product version or remediation beyond access restriction and vendor-confirmed updates.
Mitigation direction
- Check URVE vendor guidance for patches, fixed versions, or supported mitigations.
- Restrict URVE Web Manager access to trusted management networks only.
- Review and tighten authentication for Web Manager users.
- Block unnecessary access to _internal/collector/upload.php where operationally safe.
- Monitor upload directories and application logs for unexpected files.
- Consider isolating or disabling affected deployments until vendor guidance is confirmed.
Validation and detection
- Inventory all URVE Web Manager deployments and network reachability.
- Confirm whether _internal/collector/upload.php exists on deployed systems.
- Review application logs for suspicious upload activity.
- Check uploaded file locations for unexpected executable or script files.
- Verify only trusted users can access Web Manager.
- Document installed versions and compare them with any vendor advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-2419 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.15.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20upload.php%20File%20upload%20vulnerability.mdCVE reference · x_refsource_MISC
- https://vuldb.com/?id.203902CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.