CVE-2022-30628: It was possible to download all receipts without authentication

Routine

MEDIUM 4.8MITIGATE

CVE-2022-30628 is a medium-severity flaw (CVSS 4.8) affecting supersmart.me - walk through. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	4.8 (Medium)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.2% (top 92%)
CISA exploited list	No
Published	2022-07-21
Last modified	2026-06-17

Publisher (CNA): Israel National Cyber Directorate · Vendor: supersmart

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-07-21 16:15 UTCPublished CVE record published
2026-06-17 04:43 UTCUpdated Record last modified

supersmart supersmart.me - walk through MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy supersmart.me---walk-through || rpm -q supersmart.me---walk-through || supersmart.me---walk-through --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-30628?

supersmart.me - walk through: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2022-30628 being exploited?

CVE-2022-30628 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-30628 affect?

CVE-2022-30628 affects supersmart.me - walk through. Severity is medium (CVSS 4.8). It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL

How urgent is CVE-2022-30628?

Priority 19/100. No elevated risk signals yet.

Related CVEs

CVE-2022-34768 MEDIUM 6.5 MITIGATE insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inje

References

← Back to latest CVEs