What’s Vulnerable › Vulnerabilities

CVE-2022-23342

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-21 · updated 2026-06-17

Description

The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the /mobilebroker/ServiceToBroker.svc/Json/Connect endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems.

Affected products

• Hyland Onbase: before 20.3.58.1000; from 21.1.1.1000 through 21.1.15.1000 — fixed in 20.3.58.1000

How to fix

Upgrade to a fixed version: Hyland Onbase 20.3.58.1000. Check the vendor advisory for mitigations.

References

• https://community.hyland.com/login?returnUrl=/connect/hyland-research-and-development/security-advisories/username-enumeration-in-onbase
• https://github.com/InitRoot/CVE-2022-23342
• https://community.hyland.com/login?returnUrl=/connect/hyland-research-and-development/security-advisories/username-enumeration-in-onbase
• https://github.com/InitRoot/CVE-2022-23342

Get alerted when CVE-2022-23342 or the next vulnerability affects your stack