CVE-2022-36537

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://tracker.zkoss.org/browse/ZK-5150; https://nvd.nist.gov/vuln/detail/CVE-2022-36537

Remediation deadline: March 20, 2023

Ransomware use: Known

Description

ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.

Timeline

Published:February 27th, 2023 12:00 AM

Last modified:February 27th, 2023 12:00 AM

Added to KEV:February 27th, 2023

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

ZK Framework

Products

AuUploader

Weaknesses (CWE)

CWE-441

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute