CVE-2022-36537 · netVigilance record NV23-0019
ZK Framework AuUploader Unspecified
past due ransomware
What to do
Apply updates per vendor instructions.
CISA deadline 2023-03-20 · passed 3 years 5 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
Who is affected
ZK Framework AuUploader. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Weakness class: CWE-441.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 3 years 5 months ago
Sources
- NVD entry for CVE-2022-36537 nvd.nist.gov/vuln/detail/CVE-2022-36537
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- tracker.zkoss.org tracker.zkoss.org/browse/ZK-5150
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2022-36537