Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-36537

Good to know:

icon
icon

Date: August 25, 2022

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

Language: Java

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2022-36537
https://github.com/zkoss/zk/commit/92a29aa9b1daf1fd2d9d188cb6545f0441d54e84
https://github.com/zkoss/zk
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw
https://tracker.zkoss.org/browse/ZK-5150
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/
https://www.mend.io/vulnerability-database/CVE-2022-36537

Severity Score

Weakness Type (CWE)

Information Leak / Disclosure

CWE-200

Top Fix

icon

Upgrade Version

Upgrade to version org.zkoss.zk:zk:8.6.4.2,9.0.1.3,9.5.1.4,9.6.0.2,9.6.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us