CVE-2022-36344 Privilege escalation in JustSystems JUST Online Update for J-License'
An attacker can execute arbitrary code with Windows service privileges by placing a malicious file in an unquoted search path used by the JUST Online Update tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36344?
CVE-2022-36344 is a critical vulnerability in JustSystems JUST Online Update for J-License', published on 16 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
Weakness: CWE-428
Which versions are affected by CVE-2022-36344?
It affects 60 products.
Products include Justsystems Atok Medical 2, Justsystems Atok Medical 3, Justsystems Atok Pro 3, Justsystems Atok Pro 4, Justsystems Atok Pro 5, Justsystems Hanako Police 5 and 54 more.
How do I fix CVE-2022-36344?
No fix has been published for CVE-2022-36344 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-36344 being exploited?
There is no known exploitation of CVE-2022-36344 in the wild and no public exploit code.
Sources
Also known as GHSA-xqgw-r8h6-587w.