CVE-2022-34268 Deserialization in n/a
Unauthenticated Java object deserialization in RWS WorldServer allows attackers to execute arbitrary commands on the host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34268?
CVE-2022-34268 is a critical unsafe deserialization vulnerability in n/a, published on 25 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.
Weakness: CWE-502
Which versions are affected by CVE-2022-34268?
It affects 1 product.
Products include Rws Worldserver.
How do I fix CVE-2022-34268?
No fix has been published for CVE-2022-34268 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-34268 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-34268 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q565-26vc-vpx8.