Security readout for executives and security teams
Plain-English summary
A CSRF flaw in TestLink v1.9.20 could let an attacker trick a logged-in user's browser into making unintended requests to TestLink. The CVE rates potential impact as high across confidentiality, integrity, and availability, but the public bundle does not describe the exact action affected or a fixed version.
Executive priority
Prioritize remediation for any active TestLink v1.9.20 deployment, particularly internal systems used by administrators or project leads. Business urgency depends on deployment reachability and user privilege, because public evidence does not confirm exploitation or a fixed version.
Technical view
CVE-2022-35196 is CWE-352 affecting TestLink v1.9.20 via /lib/plan/planView.php. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network reachability, low attack complexity, required user interaction, and high potential impact. Public details are sparse.
Likely exposure
Exposure is most relevant to organizations running TestLink v1.9.20, especially where users remain authenticated in browsers that can reach the application. The source bundle lists affected vendor/product fields as n/a, so confirm exposure by local asset and version inventory.
Exploitation context
The CVE is not listed as CISA KEV in the bundle, and no cited source states active exploitation. CSRF generally requires a victim user to be authenticated and interact with attacker-controlled content or a malicious page.
Researcher notes
The public record gives endpoint, CWE, version, and CVSS, but lacks detailed affected CPEs, exploit status, remediation, and affected operation semantics. Treat the high score seriously while validating actual reachable workflows and relying on vendor guidance for patch direction.
Mitigation direction
- Identify all TestLink deployments and confirm whether v1.9.20 is present.
- Check official TestLink or maintainer guidance for a fixed release or advisory.
- Restrict TestLink access to trusted networks or VPN where practical.
- Limit high-privilege TestLink sessions and review user access.
- Monitor for unexpected plan or project changes until remediation is confirmed.
Validation and detection
- Inventory TestLink versions from deployment records or application administration.
- Confirm whether /lib/plan/planView.php exists in deployed instances.
- Review access logs around planView.php for unusual cross-origin timing patterns.
- Verify whether CSRF protections are present on sensitive plan workflows.
- Document any compensating access controls around TestLink.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35196 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/HuangYuHsiangPhone/CVEs/CVE reference · x_refsource_MISC
- https://github.com/HuangYuHsiangPhone/CVEs/tree/main/TestLink/CVE-2022-35196CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.