cyfenced.com →

[ CVE-2022-36537 · Published 26 Aug 2022 ]

ZK Framework AuUploader Unspecified Vulnerability

Exploited · CISA KEV CVSS 7.5 EPSS 95%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-02-27
  • Known to be used in ransomware campaigns
  • EPSS: 95% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

CISA: ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Mar 2023): Apply updates per vendor instructions.

[ References ]References