Vulnerability record · CVE-2022-31883 · published 28 June 2022

CVE-2022-31883: Marvalglobal marval msm insecure direct object reference vulnerability

Marvalglobal · Marval Msm

Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.

8.8 CVSS 3.1 High EPSS 0.98% · top 39.4% CWE-639 · Insecure direct object reference

8.8CVSS 3.1 base score, v2 4.0

0.98%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Marval Msm Marvalglobal

References

Link	Tags
https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/idor-leads-to-unauthorized-access-to-api-keys	Third Party Advisory
https://drive.google.com/drive/folders/17Q8ItseCzj5W7wlD6ZFqL0y1N5Emxz4_?usp=sharing	Broken LinkThird Party Advisory
https://marvalglobal.com/	ProductVendor Advisory
https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/idor-leads-to-unauthorized-access-to-api-keys	Third Party Advisory
https://drive.google.com/drive/folders/17Q8ItseCzj5W7wlD6ZFqL0y1N5Emxz4_?usp=sharing	Broken LinkThird Party Advisory
https://marvalglobal.com/	ProductVendor Advisory

Track CVE-2022-31883 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-31887Marvalglobal marval msm insufficiently protected credentials vulnerabilityMarval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, th…EPSS 1.6%28 Jun 2022 9.8CVE-2022-31885Marvalglobal marval msm os command injection vulnerabilityMarval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.EPSS 33%28 Jun 2022 6.5CVE-2022-31884Marvalglobal marval msm vulnerabilityMarval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including hig…EPSS 1.2%28 Jun 2022 6.5CVE-2022-31886Marvalglobal marval msm cross-site request forgery vulnerabilityMarval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.EPSS 2.2%28 Jun 2022 8.4CVE-2026-55255Langflow IDOR in responses endpoint allows cross-user flow executionLangflow before 1.9.1 has an insecure direct object reference in the /api/v1/responses endpoint. An authenticated attacker can supply another user's …KEVEPSS 0.89%analysed23 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2022-31883), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.