CVE-2022-36431 File upload in n/a
Unauthenticated attackers can execute arbitrary code by uploading a crafted JSP file in Rocket TRUfusion Enterprise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36431?
CVE-2022-36431 is a critical vulnerability in n/a, published on 1 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.
Weakness: CWE-434
Which versions are affected by CVE-2022-36431?
It affects 1 product.
Products include Rocketsoftware Trufusion.
How do I fix CVE-2022-36431?
No fix has been published for CVE-2022-36431 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-36431 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36431 exists.
Sources
Also known as GHSA-hccp-2vx9-gv82.