CVE-2022-47636 Other in n/a
Attackers can execute arbitrary code by placing malicious DLLs in the directory of a .oml file opened by the user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-47636?
CVE-2022-47636 is a high-severity vulnerability in n/a, published on 10 Aug 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
Weakness: CWE-427
Which versions are affected by CVE-2022-47636?
It affects 1 product.
Products include Outsystems Service Studio.
How do I fix CVE-2022-47636?
No fix has been published for CVE-2022-47636 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-47636 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-47636 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-fpxq-878r-vmwf.