CVE-2022-47075: Smart Office Web export pages leak employee data via action parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable sensitive data disclosure with a high EPSS score and public exploit documentation, though no confirmed in-the-wild KEV listing.

What it is

Smart Office Web 20.28 and earlier exposes sensitive information through the action name parameter on ExportEmployeeDetails.aspx and ExportReportingManager.aspx. The pages fail to properly restrict what the parameter can request, so a remote caller can pull employee and reporting-manager data they should not see. Because the data is exported directly, exposure is immediate and does not require any special tooling.

Impact

An attacker gains read access to sensitive employee and reporting-manager information exported by the application, which can support further targeting, social engineering or privacy abuse. No integrity or availability impact is described.

Attack surface

Reachable over the network through the ExportEmployeeDetails.aspx and ExportReportingManager.aspx endpoints by manipulating the action name parameter. The CVSS vector shows no privileges and no user interaction required, so it appears unauthenticated, though the record does not explicitly confirm this.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.59 (99th percentile) and a public exploit write-up is tagged in the references, indicating meaningful real-world exploitation likelihood.

What to do

• Apply the vendor fix for Smart Office Web if one is available; treat 20.28 and earlier as affected.
• If no patch exists, restrict or disable external access to ExportEmployeeDetails.aspx and ExportReportingManager.aspx.
• Enforce authentication and server-side authorization checks on export endpoints and validate the action name parameter against an allowlist.
• Monitor and log access to the export endpoints and alert on unusual or high-volume requests.
• Review exported data fields and remove sensitive attributes that are not required for the export function.

Detection

• Monitor web logs for requests to ExportEmployeeDetails.aspx and ExportReportingManager.aspx with unusual or unexpected action name values.
• Alert on export endpoint access from unauthenticated sessions or unfamiliar source IPs.
• Baseline normal export volume per user and flag spikes or off-hours bulk downloads.
• Search for the public exploit patterns referenced in the packetstorm and cvewalkthrough write-ups against these endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.