CVE-2022-36537: ZK Framework AuUploader Unspecified Vulnerability
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
Other sources
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36537?
CVE-2022-36537 has a high severity rating due to the potential for file retrieval vulnerabilities.
How do I fix CVE-2022-36537?
To fix CVE-2022-36537, upgrade your ZK Framework to the latest version where the vulnerability has been addressed.
Which versions of ZK Framework are affected by CVE-2022-36537?
CVE-2022-36537 affects multiple versions of the ZK Framework prior to version 9.6.2.
What types of attacks can be performed using CVE-2022-36537?
An attacker can exploit CVE-2022-36537 to retrieve sensitive file content from the web context.
Is there a workaround for CVE-2022-36537?
Currently, the best mitigation for CVE-2022-36537 is to apply the recommended software update.