CVE-2022-47879 A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes

What is CVE-2022-47879?

CVE-2022-47879 is a high-severity vulnerability in n/a, published on 12 May 2023.

Official description

A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.

Weakness: CWE-94

Which versions are affected by CVE-2022-47879?

It affects 2 products.

Products include Jedox Jedox, Jedox Jedox Cloud.

How do I fix CVE-2022-47879?

No fix has been published for CVE-2022-47879 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-47879 being exploited?

There is no known exploitation of CVE-2022-47879 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2022-47877 Cross-site scripting in n/a Critical 9.6
• CVE-2022-47876 Code injection in n/a Critical 9.1
• CVE-2022-47878 File upload in n/a Critical 9.1
• CVE-2022-47880 Information disclosure in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hvp3-qrpc-r6hh.