CVE-2022-36537 ZK Framework AuUploader Unspecified
Attackers can access sensitive information by sending a crafted POST request to the AuUploader component in ZK Framework.
- Exploited in the wild
- Since 27 Feb 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36537?
CVE-2022-36537 is a high-severity vulnerability in n/a, published on 26 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Which versions are affected by CVE-2022-36537?
10 open source packages ship an affected version, including org.zkoss.zk:zk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.zkoss.zk:zk Maven | All versions | 8.6.4.2 |
org.zkoss.zk:zk Maven | All versions | 8.6.4.2 |
org.zkoss.zk:zk Maven | From 9.0.0.0 | 9.0.1.3 |
org.zkoss.zk:zk Maven | From 9.0.0.0 | 9.0.1.3 |
org.zkoss.zk:zk Maven | From 9.5.0.0 | 9.5.1.4 |
org.zkoss.zk:zk Maven | From 9.5.0.0 | 9.5.1.4 |
4 more packages
org.zkoss.zk:zk Maven | From 9.6.0.0 | 9.6.0.2 |
org.zkoss.zk:zk Maven | From 9.6.0.0 | 9.6.0.2 |
org.zkoss.zk:zk Maven | From 9.6.1 | 9.6.2 |
org.zkoss.zk:zk Maven | From 9.6.1 | 9.6.2 |
Products include Zkoss Zk Framework.
How do I fix CVE-2022-36537?
Upgrade org.zkoss.zk:zk to a fixed version for your release line: 8.6.4.2, 9.0.1.3, 9.5.1.4 or 9.6.0.2. US federal agencies must fix it by 20 Mar 2023.
Is CVE-2022-36537 being exploited?
Yes. Attackers have exploited CVE-2022-36537 in the wild since at least 27 Feb 2023, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6278-2q4m-cmf3.