CVE-2022-45895

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-25 · updated 2026-06-17
Weakness: CWE-668

Description

Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclosure).

Affected products

Planetestream Planet Estream: before 6.72.10.07 — fixed in 6.72.10.07

How to fix

Upgrade to a fixed version: Planetestream Planet Estream 6.72.10.07. Check the vendor advisory for mitigations.

References

https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/

Get alerted when CVE-2022-45895 or the next vulnerability affects your stack