Description

The web application uses ZK Framework. Due to a vulnerability in the AuUploader component, an unauthenticated attacker can read arbitrary files in the web application context.

Remediation

Upgrade to the latest version of ZK Framework

References

Vulnerability in zk upload

CVE-2022-36537 Vulnerability Technical Analysis with Exp

Related Vulnerabilities

Joomla! Core 3.x.x Information Disclosure (3.0.0 - 3.8.7)

WordPress 5.7.x Multiple Vulnerabilities (5.7 - 5.7.9)

WordPress Plugin Tinymce Thumbnail Gallery 'href' Parameter Information Disclosure (1.0.7)

WordPress Plugin Order Export & Order Import for WooCommerce Information Disclosure (1.0.8)

Zabbix Guest Access

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Information Disclosure File Inclusion CWE-200 CVE-2022-36537