// For flags

CVE-2022-27599

QVR Pro Client

Severity Score

4.4
*CVSS v3.1

Exploit Likelihood

< 1%
*EPSS

Affected Versions

1
*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information via unspecified vectors. We have already fixed the vulnerability in the following version:
Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Pro Client 2.3.0.0420 and later

Se ha informado que una inserción de información confidencial en la vulnerabilidad del archivo de Log afecta al producto. Si se explota, la vulnerabilidad posiblemente proporcione a los administradores locales autenticados una ruta adicional menos protegida para adquirir la información a través de vectores no especificados. Ya se ha corregido la vulnerabilidad en las siguientes versiones: Windows 10 SP1, Windows 11, Mac OS y Mac M1: QVR Pro Client 2.3.0.0420 y posteriores

An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information via unspecified vectors. We have already fixed the vulnerability in the following version: Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Pro Client 2.3.0.0420 and later

*Credits: Runzi Zhao, Security Researcher, QI-ANXIN
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
Multiple
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2022-03-21 CVE Reserved
  • 2023-09-08 CVE Published
  • 2024-09-26 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-532: Insertion of Sensitive Information into Log File
CAPEC
  • CAPEC-215: Fuzzing for application mapping
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions (1)