CVE-2022-36537highunder attackransomware

CVE-2022-36537

Published · Updated

Follow this CVE+ Monitor AuUploader+ Monitor org.zkoss.zk:zk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 96%
from disclosure to weapon105 days
Published on NVDAug 26
1st PoC+105d
CISA KEV+185d
Action required by CISAfederal deadline: 2023-03-20

Apply updates per vendor instructions.

In short

ZK Framework has a flaw in the AuUploader component that allows attackers to access sensitive information by sending specially crafted POST requests. This exposes data that should be protected.

Technical detail

The AuUploader component in ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, and 8.6.4.1 fails to properly validate or restrict access to sensitive data when processing POST requests. An unauthenticated attacker can exploit this by crafting malicious requests to the component, resulting in information disclosure without requiring prior authentication or special privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.