CVE-2022-34002

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-16 · updated 2026-06-17
Weakness: CWE-22

Description

The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-privileged authenticated attacker to leak the configuration files and source code of the web application.

Affected products

Pdssoftware Pds Vista 7: before 7.1.7.2 — fixed in 7.1.7.2

How to fix

Upgrade to a fixed version: Pdssoftware Pds Vista 7 7.1.7.2. Check the vendor advisory for mitigations.

References

https://assura.atlassian.net/wiki/spaces/VULNS/pages/1843134469/CVE-2022-34002+Personnel+Data+Systems+PDS+Vista+7+-+Local+File+Inclusion
https://assurainc.com
https://assura.atlassian.net/wiki/spaces/VULNS/pages/1843134469/CVE-2022-34002+Personnel+Data+Systems+PDS+Vista+7+-+Local+File+Inclusion
https://assurainc.com

Get alerted when CVE-2022-34002 or the next vulnerability affects your stack