PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-45085 Gruparge CVE debrief

CVE-2022-45085 is a server-side request forgery (SSRF) vulnerability affecting Smartpower Web versions before 23.01.01. NVD maps the issue to CWE-918 and rates it CVSS 3.1 6.5/Medium. Because the attack vector is network-based and requires only low privileges with no user interaction, affected deployments should be prioritized for update and access review.

Vendor
Gruparge
Product
Smartpower Web
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2023-02-12
Original CVE updated
2026-05-18
Advisory published
2023-02-12
Advisory updated
2026-05-18

Who should care

Organizations running Smartpower Web before 23.01.01, especially administrators who expose the application to less-trusted users, networks, or integrations that could be abused to trigger server-side requests.

Technical summary

The NVD record describes a SSRF condition in Smartpower Web, with affected versions ending before 23.01.01. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating remote reachability, low attack complexity, low required privileges, no user interaction, and primary confidentiality impact. The listed weakness is CWE-918. Public references include NVD and USOM advisories.

Defensive priority

High for any environment still running Smartpower Web before 23.01.01. The combination of remote reachability, low privileges, and confidentiality impact makes this a meaningful exposure even though the overall CVSS score is Medium.

Recommended defensive actions

  • Upgrade Smartpower Web to version 23.01.01 or later.
  • Review any externally reachable or user-influenced features that can trigger outbound requests from the application.
  • Restrict network egress from the Smartpower Web host to only necessary destinations.
  • Monitor logs for unusual outbound request patterns or unexpected internal address access attempts.
  • If immediate upgrading is not possible, place compensating controls around the application and its outbound network access.

Evidence notes

The vulnerability description, affected version boundary, and severity come from the supplied CVE/NVD corpus: Smartpower Web before 23.01.01, CVSS 6.5/Medium, and CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Weakness mapping is CWE-918 from NVD and the USOM-linked advisory. Publication timing is based on the supplied CVE publishedAt value of 2023-02-12T04:15:16.397Z; modifiedAt is 2026-05-18T16:16:28.010Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-45085 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-45085

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-45085 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-45085

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.