cve/2022/CVE-2022-2192.md

### [CVE-2022-2192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2192)
![](https://img.shields.io/static/v1?label=Product&message=HYPR%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%206.10%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-425%20Direct%20Request%20(Forced%20Browsing)&color=brighgreen)

### Description

Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon