How severe is CVE-2022-30290?

CVE-2022-30290 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2022-30290 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-30290?

CVE-2022-30290 affects Citeum Opencti. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-30290?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-30290 published?

CVE-2022-30290 was published on 2022-07-05 and last updated on 2026-06-17.

CVE-2022-30290

CVE-2022-30290 is a high-severity vulnerability in Citeum Opencti with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Citeum Opencti
Published: 2022-07-05
Last modified: 2026-06-17

Description

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately.

Frequently asked questions

What is CVE-2022-30290?: In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately.
How severe is CVE-2022-30290?: CVE-2022-30290 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2022-30290 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-30290?: CVE-2022-30290 affects Citeum Opencti. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-30290?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-30290 published?: CVE-2022-30290 was published on 2022-07-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:*

More vulnerabilities in Citeum Opencti

CVE-2026-27960 — Critical (CVSS 9.8): OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0…
CVE-2026-39980 — Critical (CVSS 9.1): OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5,…
CVE-2025-24977 — Critical (CVSS 9.1): OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability…
CVE-2024-26139 — High (CVSS 8.3): OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and…
CVE-2024-45404 — High (CVSS 8.1): OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit…
CVE-2026-21887 — High (CVSS 7.7): OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16,…

All CVEs affecting Citeum Opencti →